Consolidating To A Single Service Provider? Watch Your Steps

Deciding on a managed security service provider is a huge step for any organization, especially if you're looking to get multiple capabilities from that lone provider.

But handling the ongoing relationship after you've chosen the provider might be even more important, experts say.

Most enterprises these days are hiring a single managed security service provider, not multiple providers, experts say. This means you'd better be sure you find one you can work with over the long haul.

"As a company that wades into this, you have to look at the longer-term vision," says Mike Mulville, CTO at SAIC, which offers security and professional services. "You have to look further down the road and ask if the vendors have the capability to do what you need to do."

With the tough economy, some companies have slimmed down their IT security departments, and many are looking to find a managed security service to fill the gaps. Cost has been a chief reason for outsourcing in the past, as well as expertise and 24x7 support.

"People are coming to us because they don't have the expertise to deal with threats," says Joe Blanda, executive director at AT&T managed security services. "The complexity is at the point that people don't want to have to deal with it."

Such demands have boosted the managed security services market to skyrocketing growth -- the market is projected to increase from $1.2 billion in 2009 to $3.9 billion in 2016, according to research firm Frost & Sullivan.

But while the need for a variety of services is growing, most enterprises would rather use one provider, experts say. "Using one vendor that can help with all these headaches seems to be appealing to the customers," says Martha Vazquez, a research analyst for Frost & Sullivan.

Once you decide on a provider, it's equally important to manage the relationship carefully, observers say. For example, make sure you are meeting regularly -- at least monthly -- with your provider, SAIC's Mulville says. Rather than review performance every few years when it's time to sign a new contract, companies should check in regularly. Good providers will meet often with clients to discuss ongoing performance and any significant security incidents, he says.

"Over time, the [service providers'] ability to show value has gotten better," Mulville says. "[Meeting with clients] is a greater opportunity to do that, so you don't have to wait for contract time."

Rewarding providers for finding and reporting evidence of security events can result in better security, according to a recent report.

In a 2008 report, research firm Aberdeen classified security services users into three categories -- best-in-class, average, and laggards -- based on metrics measuring their security. Almost three-quarters of best-in-class firms had good communications with their providers, compared to 56 percent of laggards. Six out of 10 companies in the top class had a specific person or committee assigned to evaluating the suitability of managed security service providers, compared to 44 percent for laggards.

Such centralized management can help companies communicate new needs to their providers, Vazquez says. Customers should also look for providers that allow mixing and matching of services, she says.

"Offering a mix of services and flexibility will allow the customer to utilize different price points and packages tailored for their needs," Vazquez says. "I believe just finding an MSSP that will stay ahead of the trends through innovation and offering various new services will help the customer maximize its benefits."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.