What is an MSSP and how do you choose one?

An MSSP (managed security service provider) is a company that operates all or part of its clients’ cybersecurity: monitoring, threat detection, incident response and management of security tools. To choose an MSSP, look beyond the label at the real scope of service, genuine 24/7 coverage, incident response capability and how the provider works with you.

This article is part of our series on choosing a SOC. The main guide is How to choose a SOC provider, which sets out every selection criterion.

What is an MSSP?

The NIS2 directive offers a useful definition. It distinguishes:

• the managed service provider (MSP): it installs, manages, operates or maintains ICT products, networks, infrastructure or applications for its clients (Article 6(39));
• the managed security service provider (MSSP): a managed service provider that carries out or assists with cybersecurity risk management activities (Article 6(40)).

Put simply, the MSP keeps the IT running; the MSSP keeps it protected. One company can be both. Both categories appear in NIS2 Annex I, under “ICT service management (business-to-business)”.

What does an MSSP do?

Services vary widely between providers:

Service	What it delivers
Managed SOC	Continuous monitoring, alert detection and triage
MDR	Detection and response on endpoints, usually through an EDR
Incident response	Containment, investigation and remediation after an attack
Vulnerability management	Inventory of weaknesses and tracking of fixes
Device management	Firewall and email gateway administration
Assessment and advice	Security posture reviews and action plans

The term MSSP alone does not tell you what you are buying. To untangle the acronyms, see EDR, MDR and XDR: what are the differences?.

MSSP or MSP: who does what?

For a small business, the question is often this: my MSP already runs my IT, do I need another provider? Not necessarily. Many MSPs now offer managed security services backed by a partner SOC. The client keeps a single point of contact, while specialist analysts handle the monitoring.

For how responsibilities are split, see Managed SOC and MSP: who does what?.

How to choose an MSSP

Real scope

Ask for a precise list of what is monitored (endpoints, servers, Microsoft 365 or Google Workspace, firewalls) and what is not. A “managed security service” can range from an alert console to a team that genuinely intervenes.

24/7 coverage

Attacks keep no office hours. Check that analysts are actually on shift at night and at weekends, and where they work.

Incident response

What happens once an attack is confirmed? Who isolates the device, who investigates, how fast, and at what cost? Response that has to be scoped and contracted in the middle of a crisis can delay action when time matters most, so it is worth knowing the contractual terms before an incident.

Integrations

The MSSP must work with your existing tools, especially your EDR and email platform. Ask which tools are supported natively and what happens with the others.

Certifications

ISO 27001 shows a security management system is in place. National schemes add detail where they exist: in France, ANSSI qualifies detection (PDIS), incident response (PRIS) and audit (PASSI) providers. Where the provider is based and operated also matters for data protection; see Why choose a European SOC provider?.

Commercial model

Some MSSPs sell directly, others work through MSPs. If you are an MSP, make sure the MSSP will not approach your clients and that it provides reports under your brand. See SOC for MSP: what it is and how it works.

How Cyna works

Cyna is a managed SOC pure player. Its 24/7 SOC is operated from France by in-house teams, alongside a CERT that is a member of InterCERT France. Cyna works through its MSP partners, who own the client relationship, contract and billing, and can export white label reports. Cyna’s incident response on-call team is available 24/7 from the Report an incident page. Cyna’s certifications and security documents are available on its Trust Center.

Talk to an expert

Comparing MSSPs, or looking to add a SOC to your managed services? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

What is the difference between an MSSP and a managed SOC?

A managed SOC is a service: monitoring, detection and response. An MSSP may offer it alongside other services, such as firewall management or vulnerability management. See What is a managed SOC?.

Can an MSP become an MSSP?

Yes. Many MSPs add managed security services by relying on a partner SOC rather than building a 24/7 team of their own. See How can MSPs resell a white label SOC?.

Is an MSSP subject to NIS2?

Managed security service providers are listed in NIS2 Annex I, and the directive generally applies from the medium-sized enterprise thresholds, subject to how each EU country has transposed it. Whether a given provider is in scope is a question for its legal adviser.

Which certifications should an MSSP hold?

ISO 27001 shows a security management system is in place. Some countries add national schemes: in France, ANSSI qualifies detection (PDIS), incident response (PRIS) and audit (PASSI) providers.