Who can contain a threat when your team is offline?

Agree the action, asset and authority

A promise of 24/7 monitoring does not tell you who can isolate a laptop or disable an account. Ask the provider to document the actions included in your package and demonstrate the permissions that make them possible.

For example, Microsoft Defender Experts MDR Plan 1 distinguishes investigation access from direct-response access. Devices and users excluded from response still receive guidance. Assets outside an agreed coverage scope receive neither managed response nor guidance. The service does not let buyers customize permissions by individual response action, so a buying worksheet must reflect the controls the service actually supports. See Microsoft’s onboarding instructions, managed-response FAQ and scoped coverage guidance.

Use these prompts to record the agreement for your environment:

• Endpoint isolation: Which device groups are covered? Which critical systems are excluded? Who can approve isolation and later reconnection?
• Account containment: Can the provider disable an account or revoke sessions? How are privileged, service and emergency-access accounts handled?
• Network or cloud changes: Which controls can the provider change directly? Which actions require your network, cloud or application owner?
• Evidence and handoff: Where are the reason, approver, action and result recorded? Who checks that containment succeeded?

Do not treat a connector as permission to act. Validate the actual action path during onboarding, using a safe test agreed with the system owner.

Test the unanswered call

Walk through one scenario before signing: a high-severity identity alert arrives at 02:00 and the primary contact does not answer.

Ask the provider to show who investigates, which preapproved action can proceed, how it records the result and when it contacts the backup. For an excluded asset, identify the person who can authorize or perform the action. Record the fallback if that person is also unavailable. Silence should not become an undocumented approval rule.

Check what the response clock measures. An acknowledgment, a completed investigation and a successful containment action are different events. Agree which timestamp starts each commitment and what happens when access, telemetry or customer approval is missing.

Assign recovery before the incident

Containment may interrupt legitimate work. Name the person who decides when an account or device can return to service, verifies remediation and coordinates any wider incident-response help. Keep a backup contact for that role as well.

NIST’s incident-response guidance treats preparation, response and recovery as connected responsibilities. Use the onboarding exercise to test the handoff between your provider, IT team and business owners, then revisit it when critical assets, contacts or permissions change.

When comparing SOC providers, shortlist by the work they take on after an alert. Confirm the operating agreement behind the lane label before relying on after-hours coverage.