What an MSSP Does for a Small Business (and What It Doesn’t)

A managed security service provider (MSSP) watches your computers, accounts and network for signs of attack, investigates what it finds, takes agreed first steps to contain a threat, and reports to you on what happened and what needs fixing. For a small or mid-sized business, that means getting a security team’s eyes on the environment without hiring a night shift. It does not mean handing off responsibility. You still own the decisions, the policies and the legal obligations.

This guide explains what an MSSP does day to day, translates the acronyms, covers how monitoring hands off to incident response, shows where providers help with CMMC, HIPAA and the FTC Safeguards Rule, and gives you a contract checklist. It reflects how we approach our own managed cyber security and MSSP service, but the questions apply to any provider you consider.

The core job: watching, deciding and acting

Attackers do not keep office hours. A stolen password used at 2 a.m. on a Saturday, a laptop that starts encrypting files, or a mailbox rule that quietly forwards invoices to an outside address all need someone to notice and decide what to do. That is the center of an MSSP’s work.

A typical overnight alert runs like this:

1. Detect. Software on a laptop flags a suspicious program, or the identity system sees a login from an unusual country.
2. Triage. An analyst checks whether it is real or routine, such as a scheduled admin script or a traveling employee.
3. Contain. If it is real and the action is pre-approved, the analyst isolates the laptop from the network or disables the account.
4. Escalate. The analyst contacts your named person by the agreed method, explains what happened and what was done, and asks for decisions only you can make.
5. Report. The event goes into a written record with the timeline, evidence and recommended fixes.

The value is in steps 2 through 4. Tools that generate alerts are easy to buy. People who can tell a real attack from noise, and who have written authority to act, are what you are paying for.

SOC, MDR, EDR and SIEM in plain English

Providers mix these terms freely. This table gives the short version and the question that cuts through marketing. For a deeper comparison, see our guide to SOC vs. MDR vs. EDR vs. SIEM.

Term	What it means	Question to ask
SOC (security operations center)	The team, process and tools that watch for and respond to threats	Who staffs it overnight, and are they your employees or a subcontractor’s?
EDR (endpoint detection and response)	Software on laptops and servers that records activity and can stop or isolate threats	Which devices are covered, and who acts on its alerts?
SIEM (security information and event management)	A system that collects logs from many sources and looks for patterns across them	Which log sources are connected, and how long are logs kept?
MDR (managed detection and response)	A service where the provider operates detection tools and responds, not just alerts	What exactly can you do without calling us first?
XDR (extended detection and response)	Detection that combines endpoint, email, identity and cloud signals	Which of our systems feed it today?

Beyond alerts: vulnerabilities, email and identity

Good monitoring catches attacks in progress. The rest of an MSSP’s work reduces how many get that far.

Vulnerability management

Scanning finds missing patches and risky settings. The useful part is prioritization: which of hundreds of findings are exposed to the internet, are being actively exploited, and sit on systems that matter. Expect a short, ranked list with owners and due dates, not a thousand-line report.

Email security

Email is still a main entry point. The FBI’s Internet Crime Complaint Center recorded about $3.05 billion in reported business email compromise losses in 2025. An MSSP can filter malicious messages, watch for suspicious mailbox rules and forwarding, and help set up sender authentication (SPF, DKIM and DMARC) so criminals cannot easily spoof your domain.

Identity

Most modern attacks use stolen logins. Monitoring sign-ins, enforcing multi-factor authentication and flagging impossible travel or new admin accounts often stops an intrusion before any malware runs.

Where monitoring ends and incident response begins

Isolating a laptop is containment. Figuring out how the attacker got in, what they touched, whether data left, and what you must tell regulators is incident response, and it is a larger job. NIST’s incident response guidance, updated as SP 800-61 Revision 3 in April 2025, treats response as part of overall risk management, which includes preparation long before an incident.

Clarify these points with any provider:

• Is full incident response included, billed hourly, covered by a retainer, or referred to another firm?
• Will the provider preserve evidence (logs, disk images, memory) in a way that holds up for insurers, counsel and possibly court?
• Is the provider acceptable to your cyber insurer, or does the policy require a specific panel firm?
• Who coordinates with your attorney so findings are handled under counsel’s direction?

Timing matters because notice deadlines start running. Arizona’s breach law (A.R.S. 18-552) requires notifying affected individuals within 45 days after determining a breach occurred, and adds notices to the three largest consumer reporting agencies, the Attorney General and the Arizona Department of Homeland Security when more than 1,000 people must be notified. Other states set their own rules. Our cyber incident response page covers how we run that phase.

Compliance support: CMMC, HIPAA and the FTC Safeguards Rule

An MSSP can produce much of the evidence auditors and assessors want: log reviews, vulnerability scans, access reports and incident records. Each framework also says something about the provider itself. This is general information, not legal advice.

CMMC (defense contractors)

The CMMC program rule (32 CFR Part 170) took effect December 16, 2024, and the companion acquisition rule took effect November 10, 2025, starting Phase 1 of a four-phase rollout. Phase 2, which adds third-party Level 2 assessments for applicable contracts, begins one year after Phase 1, on November 10, 2026. The rule defines an External Service Provider as one that processes, stores or transmits CUI or Security Protection Data, which explicitly includes log data. In practice, an MSSP that collects your security logs generally falls within your assessment scope, so ask what documentation it provides. Our CMMC 2.0 compliance guide covers levels and timelines.

HIPAA (health care and business associates)

The HIPAA Security Rule requires covered entities and business associates to regularly review records of system activity, such as audit logs and access reports (45 CFR 164.308). It also requires a written business associate agreement before a vendor can create, receive, maintain or transmit electronic protected health information for you. A provider that monitors systems holding patient data should sign one without hesitation.

FTC Safeguards Rule (non-bank financial businesses)

The rule covers more businesses than many owners expect, including mortgage brokers, tax preparers, collection agencies and certain auto dealers that lease vehicles. Under 16 CFR Part 314, your Qualified Individual may work for a service provider, but you keep responsibility for compliance and must designate a senior person to oversee them. Without effective continuous monitoring, you need annual penetration testing and vulnerability assessments at least every six months. You must also select capable providers, require safeguards by contract and assess them periodically. Since May 13, 2024, events involving information of at least 500 consumers must be reported to the FTC within 30 days of discovery. See our FTC Safeguards Rule compliance guide for detail.

How to evaluate an MSSP contract and SLAs

Service level agreements (SLAs) are where similar-looking proposals differ. Read them with these questions in hand.

Contract checklist

1. Definitions. What counts as “response”: an email, a phone call, or actual containment? How are severity levels defined, and who sets them?
2. Pre-approved actions. Which steps (isolate a device, disable an account, block an address) may the provider take without calling you?
3. Coverage. Which devices, servers, cloud tenants and SaaS apps are in scope? What happens when you add new ones?
4. Staffing. Is the SOC operated by the provider or subcontracted? Where are analysts located, and who can access your data?
5. Escalation. Who gets called, in what order, at what hours, and what happens if nobody answers?
6. Log retention and access. How long are logs kept, can you export them, and are they available to your insurer or forensic examiner?
7. Incident response. Included, retainer, hourly or referred? What rates and limits apply?
8. Reporting. What does the monthly report contain, and will a non-technical owner understand it?
9. The provider’s own security. How do they protect their access to your systems, and how fast will they tell you if they are breached?
10. Compliance paperwork. Will they sign a business associate agreement, support CMMC documentation, or meet Safeguards Rule contract terms?
11. Ownership and exit. Who owns configurations, logs and documentation, and how are they handed back if the contract ends?
12. Liability and insurance. What are the liability caps, and what insurance does the provider carry?

What stays your job

An MSSP extends your team. It does not replace the decisions only an owner can make. Plan to keep these:

• Business decisions. Shutting down a production system, paying or not paying a ransom, and when to bring in counsel.
• Access approvals. Who gets accounts and admin rights, and removing departing employees the day they leave.
• Telling the provider about change. New offices, new cloud apps, new remote access tools and new vendors. A provider cannot monitor what it does not know exists.
• Patch windows and downtime. Unless patching is in scope, your IT team or provider still applies fixes.
• Backups that actually restore. Test them on a schedule, and keep at least one copy attackers cannot reach.
• Policy and people. Approving security policies, enforcing them, and supporting training so staff report suspicious messages.
• Legal obligations. Breach notifications, regulatory filings and contract notices are decided by you and your attorney.

How Honeybadger Solutions helps

Honeybadger Solutions LLC is a veteran-led cyber, security and investigations firm headquartered in Casa Grande, Arizona, with offices in Phoenix and Oro Valley. Our managed cyber security and MSSP service is delivered remotely, so it is available to small and mid-sized organizations anywhere in the US. It includes around-the-clock monitoring, alert triage and agreed containment, vulnerability management, email and identity protection, reporting written for owners, and compliance evidence for frameworks such as CMMC, HIPAA and the FTC Safeguards Rule.

When an incident goes beyond containment, our in-house incident response and digital forensics capabilities pick up the investigation with evidence preserved for insurers and counsel. We put scope, pre-approved actions and escalation paths in writing during onboarding, and quotes are written and given before any work starts.

To compare our scope against your current setup, request managed security services online or book a confidential consultation. If you think you are under attack right now, use our urgent intake form.

Frequently asked questions

Is an MSSP the same as a managed IT provider?

No. A managed IT provider keeps systems running: help desk, patching, new laptops. An MSSP focuses on detecting and responding to threats. Many businesses use both, and the two need clear lines on who patches, who monitors and who responds.

Does a small business really need 24/7 monitoring?

Attackers do not wait for business hours. If no one can act on an alert until Monday morning, an attacker may have had a full weekend inside your systems. Around-the-clock monitoring closes that gap without hiring overnight staff.

Will an MSSP make us compliant?

No provider can make you compliant on its own. It can supply monitoring, log reviews, scans and records that support compliance, but frameworks such as the FTC Safeguards Rule state that you keep responsibility. Policies, risk decisions and oversight remain yours.

What should an MSSP be allowed to do without asking us?

Common pre-approved actions include isolating an infected device, disabling a compromised account and blocking a malicious address. Larger steps, like shutting down a server that runs operations, should require your approval. Put the list in writing before coverage starts.

How do we leave an MSSP if it is not working?

Check the contract before you sign for exit terms, data return and log export. You should get your configurations, documentation and logs back in a usable format, and agents should be removed cleanly.

Sources: FBI IC3 2025 Internet Crime Report, NIST SP 800-61 Rev. 3, Incident Response Recommendations (2025), A.R.S. 18-552, Arizona breach notification, 32 CFR Part 170, CMMC Program, 48 CFR Subpart 204.75, CMMC acquisition rule, 45 CFR 164.308, HIPAA administrative safeguards, 16 CFR Part 314, FTC Safeguards Rule, FTC: Safeguards Rule, What Your Business Needs to Know

Related reading

• ▸ The Glass Castle: Securing the Executive Home Network
• ▸ Mexico Security Threat Report 2026: Cross-Border Risk Assessment for US Business Operations
• ▸ Managed Security Services (MSSP): What They Are and Why Your Business Needs One
• ▸ Data Breach Response for Small Business: A Step-by-Step Plan