- [Instructor] As organizations seek to outsource
components of their technology infrastructure,
they often turn to vendors to perform tasks
that they either consider commodities
or believe can be more efficiently
and effectively performed by a third party.
In some cases, this means turning to outside firms
to provide critical security services.
Vendors that provide security services
for other organizations are known as
managed security service providers, or MSSPs.
MSSPs play a critical role in the organization's
security program and should be carefully monitored
to ensure that they are living up to their status
as trusted partners and are effectively meeting
the organization's security objectives.
MSSPs vary widely in the scope of their services
and may perform different services for different clients.
Some MSSPs take over complete responsibility
for managing an organization's security infrastructure.
Others perform a specific task,
such as log monitoring, firewall and network management,
or identity and access management.
Organizations that are considering using an MSSP
should develop a written agreement
that outlines clear responsibilities,
provides service level agreements,
and explicitly covers incident notification
and response practices.