Briefing
Managed service pricing often rewards the wrong things. Hourly billing pays for problems. Hardware margin pays for bigger boxes. Neither pays for prevention.
Compare providers on a common scope instead. CISA's Cybersecurity Performance Goals provide a public baseline of high-value practices, and the KEV catalog defines what to fix first. Compliance evidence should come from daily operations, not an annual scramble.
One thing a plan should not include is the provider certifying itself. HHS says it does not recognize private HIPAA Security Rule certifications.
What to do
- Require these in scope: help desk with ticket tracking, monitoring and alerting with investigation, patching, MFA and account management, backups with restore tests, and vulnerability management that puts KEV first.
- Specify the compliance framework you answer to and the evidence the provider will maintain.
- Ask how the provider is paid on hardware and licenses. Prefer a spec list you can buy from anywhere.
- Ask what managed platform runs the environment. Ours is Ares RMM.
- Keep audit with an independent party.
How to verify
- Request a sample monthly report before signing.
- Ask for the median time to close KEV findings across current clients, if they track it. If they do not track it, note that.
- Confirm the contract states fixed scope and price in writing.
Sources
- CISA, Cybersecurity Performance Goals 2.0
- CISA, Known Exploited Vulnerabilities catalog
- HHS FAQ, Are we required to certify our organization's compliance with the Security Rule?
Want help putting this in place? Contact Computer Plus.