Vendor SOC coordination expectations

Overview

Your MDR/SOC vendor sees part of the picture only. Expectations must be contract + runbook-aligned.

Information they need fast

Tenant IDs, authorized contacts, scope (which subsidiaries), comms bridge (phone), legal hold status affecting log deletion.

SLA realism

Critical phone bridge within minutes; deep hunt hours—don’t conflate alert triage with full incident.

Artifacts

Request timeline export of their analyst actions; MISP IOC share back to your SIEM.

Gaps

If they cannot see SaaS admin logs, that’s your gap—not magically theirs mid-incident.

Misalignment

Commercial SOC won’t execute active containment on-prem without SOW—pre-authorize playbooks.

After-action

Joint retro within 10 business days; RFP penalty discussion if missed escalation proved.

Data protection

NDA covers customer name in their tickets—verify before sharing PHI artifacts.

KPIs

True positive rate, escalation accuracy, mean time to hand you actionable summary—track quarterly.