Who owns the gaps between your security providers?

Your IT provider, cloud platform, monitoring service, and internal team may each have a defined role. The question is whether their work connects. An alert can be delivered correctly while the authority to act on it remains unclear. The same gap can open inside one organization; what matters is the boundary, not the number of suppliers.

Start with a task that matters

Choose one concrete event: a departing employee, a serious security alert, a failed backup, or a newly exposed system. Trace it from the first signal to confirmed completion.

Ask who receives the signal, who decides what it means, who can approve action, who performs the work, and who checks the result. Include the fallback if the first contact is unavailable. A broad statement that a task is “shared” leaves those questions open.

A hypothetical handoff

Imagine a monitoring provider sends an alert about suspicious account activity to an IT support queue. Its agreement covers notification. The IT team can disable the account, but requires approval from a business contact who is unavailable overnight.

Both providers may have followed their agreements. The gap is the unresolved approval path during the hours when the organization expects action. The business needs to decide whether to authorize defined containment in advance, arrange another approver, or explicitly accept a delay.

That decision should consider the disruption that containment could cause as well as the risk of waiting. Faster action is useful when the authority, conditions, and consequences are understood.

Write down the handoff

For each selected task, record these details in plain language:

• Name the team or role responsible for starting the work and the event that triggers it.
• State the coverage hours and the expected acknowledgment or action time.
• Identify the approval required and the person or role able to give it.
• Describe what the next team receives, including the information needed to act.
• Specify how completion is confirmed and who handles unresolved work.

Ask the participating teams to confirm the record. Use a walkthrough to check whether everyone interprets it the same way. A walkthrough tests understanding; it does not by itself prove that the live process works.

Check an actual example

Where appropriate, review a recent ticket or other operational record with sensitive details removed. Look for the trigger, acknowledgment, approval, action, and closure. Compare the sequence with the agreed process and identify what the record cannot establish.

If no suitable example exists, agree on how the process will be checked next. Do not label it effective merely because the document is complete, or failed merely because historical evidence is unavailable.

Resolve the boundary before buying another service

The next step might be a clarified contract, a change to an internal approval process, or additional coverage. Match the action to the demonstrated gap.

Our guide to MSP contracts helps you check the purchased scope.