For an organization that operates in several countries, 24/7 security monitoring means a security operations team watches your identity, email, endpoints, network and cloud logs every hour of every day, investigates what looks wrong, takes pre-approved containment steps, and reaches the right person in the right country when a decision is needed. The tools matter less than the operating rules: which logs are collected, who is called at 3 a.m. in each region, what the analysts may do without asking, and where your log data is allowed to go.
This guide covers those operating rules for multi-country organizations: the log sources to onboard, follow-the-sun escalation, after-hours decision rights, a contact matrix template, moving log data across borders, regulator reporting clocks and how to read the service level agreement. It reflects how we run our own 24/7 managed security monitoring (MSSP) service, but the questions apply to any provider.
Key takeaways
- Onboard identity, email and endpoint logs first. They show most attacks earliest, in every country.
- Follow-the-sun works only if each region has a named, reachable contact with authority to approve actions, plus a backup.
- Write after-hours decision rights before go-live: what analysts may do on their own, what needs a call, and what only an executive can decide.
- Security logs contain personal data. Moving them between the EU, UK and US needs a transfer mechanism, such as the EU-US Data Privacy Framework or standard contractual clauses.
- Regulator clocks can be short (24 hours for a NIS2 early warning, 72 hours under GDPR). Monitoring and escalation have to feed counsel fast enough to meet them.
- In an SLA, look for separate targets for acknowledging, investigating and containing, not one headline number.
What 24/7 monitoring covers across countries
The basic loop is the same everywhere: detect, triage, contain, escalate and report. If you need the acronyms sorted out first, our explainer on SOC vs MDR vs EDR vs SIEM covers what each one does.
Operating in several countries adds three complications. First, “normal” activity looks different in each region, so detection rules tuned for one office flag every login from another. Second, the people who must approve actions sleep at different times. Third, data protection and incident reporting rules change at each border. A provider that monitors a single-country company well can still fail a global one if it has not planned for all three.
Log sources to onboard first
Collecting every log on day one is expensive and slow. Start with the sources that show attacks early and cover every country at once, then add regional systems.
| Log source | What it shows | Priority |
|---|---|---|
| Identity platform sign-in and audit logs | Stolen passwords, MFA fatigue, impossible travel, new admin roles | First |
| Email platform (Microsoft 365 or Google Workspace) | Phishing, malicious inbox rules, mailbox forwarding, business email compromise | First |
| Endpoint detection and response on laptops and servers | Malware, ransomware behavior, suspicious scripts, lateral movement | First |
| Firewalls, VPN and remote access | Unusual inbound access, connections to known bad hosts, data leaving the network | Second |
| Cloud control planes (AWS, Azure) | New resources, changed permissions, disabled logging | Second |
| Business-critical SaaS (finance, CRM, HR) | Bulk exports, access from unmanaged devices, privilege changes | Third |
| Backup platform | Deleted backups or changed retention, often a ransomware warning sign | Third |
Agree on retention as well as collection. A joint advisory on managed service providers from US, UK, Australian, Canadian and New Zealand cyber agencies recommends that organizations store their most important logs for at least six months. Longer retention may be required by your sector or contracts.
Follow-the-sun escalation
A follow-the-sun model routes each alert to someone who is awake and responsible for the affected region. The SOC itself runs around the clock, but your side of the escalation has to work in every time zone too.
- Name a primary and backup contact per region. If your Singapore office is hit at 2 p.m. local time, the call should go to someone there or someone covering for them, not to headquarters at midnight.
- Define a global incident owner. Regional contacts handle local decisions, but one person (often the CIO, CISO or a virtual CISO) owns incidents that cross regions.
- Load local holidays. Escalation rosters fail on public holidays that headquarters does not observe.
- Agree on the contact method. Use a channel that does not depend on the systems under attack. If email is compromised, an alert sent by email may reach the attacker first.
- Set a language rule. Decide which language escalations use and whether regional contacts need a translator for technical calls.
After-hours decision rights
Overnight monitoring loses its value when an analyst sees a real attack and has to wait hours for permission to act. The fix is a written list of decision rights, agreed before go-live.
| Action | Typical decision right |
|---|---|
| Isolate a laptop or server showing ransomware or malware behavior | Analyst may act, then notify |
| Disable a user account or revoke sessions after confirmed credential theft | Analyst may act, then notify |
| Block a malicious domain, IP address or email sender | Analyst may act, then notify |
| Disable an executive’s or service account | Call the regional contact first, act if no answer within the agreed time |
| Isolate a production server, a site network or an operational system | Requires approval from the regional or global incident owner |
| Engage outside counsel, the insurer or law enforcement | Your decision; the provider supplies facts |
| Notify a regulator, customers or the public | Your decision with counsel; the provider supplies the timeline |
Tailor the list. A manufacturer may never want a plant system isolated without a call, while a professional services firm may want laptops isolated on sight. What matters is that it is written, signed and tested in a tabletop exercise. Our post on incident response plans and tabletop exercises shows how to run one.
A contact and escalation matrix template
Every monitoring contract should come with a matrix like the one below, kept current and shared with the provider. Fill one row per role per region.
| Role | Region and time zone | Primary and backup | Contact method | May approve | Contact when |
|---|---|---|---|---|---|
| Global incident owner | Headquarters | Name / backup name | Out-of-band call and secure messaging | Any containment, outside help | High or critical incidents, any region |
| Regional security contact | Each region | Name / backup name | Call, then messaging | Regional account and device actions | Any confirmed incident in the region |
| IT operations lead | Each region or global | Name / backup name | Call | Server, network and system changes | Containment that affects operations |
| Legal or privacy counsel | Per country as needed | Name / firm | Call via incident owner | Notification decisions | Possible personal data exposure |
| Executive sponsor | Headquarters | Name | Call via incident owner | Business shutdowns, public statements | Critical incidents |
| Cyber insurer claims line | Per policy | Policy number | Per policy terms | Approved vendors and costs | As the policy requires, often early |
Moving log data across borders
Security logs are full of personal data: names, email addresses, IP addresses, device identifiers and sign-in locations. If your SOC analyzes logs from EU or UK staff in the US, that is an international transfer of personal data and needs a legal basis.
The EU-US Data Privacy Framework is one option. The European Commission adopted its adequacy decision on July 10, 2023, covering US commercial organizations that self-certify to the framework. Participants must re-certify every year, and onward transfers to agents or processors require a contract. Check that your provider, and any US subprocessor it uses, appears on the active list at the Data Privacy Framework program site. Because adequacy decisions can be challenged or changed, many organizations also keep standard contractual clauses in place as a fallback. Transfers from the EU to the UK rely on the Commission’s UK adequacy decisions, which were renewed on December 19, 2025.
Practical steps:
- Ask where logs are stored and from which countries analysts can access them.
- Get a data processing agreement that names the transfer mechanism and lists subprocessors.
- Collect only the log fields detection needs, and set retention by data type.
- Check local rules on monitoring employees, which differ from country to country.
This is general information, not legal advice. Confirm transfer and monitoring requirements with counsel in each country where you operate.
Regulator reporting clocks to plan around
Monitoring does not decide whether to notify a regulator, but it starts the clock. Your escalation path must bring counsel the facts quickly enough to meet the shortest deadline that applies. A few examples, as of October 2026:
- EU GDPR: notify the supervisory authority of a personal data breach without undue delay and at the latest within 72 hours of becoming aware of it, where it is likely to pose a risk to individuals.
- UK GDPR: report a notifiable breach to the ICO within 72 hours of becoming aware of it.
- EU NIS2 Directive: covered entities give an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month, under each member state’s national law.
- EU DORA: financial entities report major ICT-related incidents to their competent authorities. DORA has applied since January 17, 2025.
- US SEC: public companies disclose a material cybersecurity incident on Form 8-K, generally within four business days of determining it is material.
Sector regulators, US state breach laws and contracts add their own deadlines. This is general information, not legal advice. Confirm which rules apply with counsel in each country.
How to read an MSSP SLA
A monitoring service agreement for a multi-country organization should answer each of these questions in writing:
- Priority definitions. What makes an alert critical, high, medium or low, and are definitions the same for every region?
- Separate targets. Is there a target to acknowledge, to begin investigating and to contain or escalate? “Response” alone can mean an automated email.
- Coverage. Are analysts working 24/7/365, including weekends and holidays in your regions?
- Containment authority. Which actions may the provider take without approval, and is that list attached?
- Incident response. Is hands-on response included, capped in hours or billed separately?
- Log sources and retention. Which sources are in scope, how long data is kept and where it is stored.
- Transfers and subprocessors. The transfer mechanism and a current subprocessor list.
- Reporting. What you receive monthly and after each incident.
- Exit. How you get your logs, detection rules and documentation back when the contract ends, and how the provider’s access is removed.
How Honeybadger Solutions helps
Our managed security and MSSP service provides 24/7 SOC coverage of your endpoints, network and cloud, including hardening and monitoring for Microsoft 365, Google Workspace, AWS and Azure. Our analysts triage and tune alerts, investigate phishing, malware and lateral movement, and take the containment steps you approve. When an incident needs hands-on work, our cyber incident response team contains it, removes the attacker, restores operations and documents a timeline for counsel, insurers and regulators.
The work is delivered remotely by our own team to organizations across the US and internationally. We build the escalation matrix and decision rights with you during onboarding, and response targets are written into each service agreement. Quotes are written and given before any work starts. To set up round-the-clock monitoring for your operations, request managed security monitoring online. If you are dealing with an active incident, use our urgent intake form.
Frequently asked questions
Do we need a SOC in each country where we operate?
Usually not. One SOC can monitor every region remotely, as long as it collects logs from all of them, tunes detections for regional patterns and escalates to contacts in each region. Data protection rules may affect where logs are stored and who may access them, so confirm that with counsel.
What should analysts be allowed to do without calling us?
Most organizations pre-approve isolating an infected laptop, disabling a compromised account and blocking a known malicious domain or sender. Actions that can stop operations, such as isolating a production server, normally need a call first. Write the list down and test it.
Can a US provider monitor logs from EU employees?
Yes, with a valid transfer mechanism such as the EU-US Data Privacy Framework (if the provider is certified) or standard contractual clauses, plus a data processing agreement. This is general information, not legal advice, so confirm requirements with counsel in each country.
Does 24/7 monitoring include incident response?
It depends on the contract. Monitoring usually includes triage and initial containment, while full investigation and recovery may be included, capped or billed separately. Read that section of the agreement before you sign.
Who decides whether to notify a regulator?
You do, with your counsel. The monitoring provider supplies the facts and timeline, and escalation must be fast enough for counsel to meet deadlines such as the 72-hour GDPR clock.
Sources: Joint advisory AA22-131A, Protecting Against Cyber Threats to MSPs and their Customers (CISA, NSA, FBI, NCSC-UK, ACSC, CCCS, NCSC-NZ), EUR-Lex, Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework), Data Privacy Framework program, European Commission, adequacy decisions, European Commission, data breach obligations, ICO, personal data breaches guide, EUR-Lex, Directive (EU) 2022/2555 (NIS2), EIOPA, Digital Operational Resilience Act, SEC, cybersecurity disclosure rules (2023)
Browse by topic
Security guard services · Private investigations · Cybersecurity · Digital forensics · Financial fraud investigation · Executive protection · All articles