Between the volume of abbreviations in technology and the scope of cybersecurity, it’s easy to lose track of who is responsible for what when it comes to keeping your data protected and your reputation intact.
As is the nature of leadership, your organization’s top executive (CEO, ED, etc.) is ultimately accountable for all things cybersecurity. But responsibility for doing the work sits with a combination of parties that it can be difficult to distinguish between.
With over 30 year of experience serving the technology needs of law firms, associations, and consulting firms, we have seen all sorts of internal technology support structures—some of which are more successful than others.
Since there are multiple aspects to how your cybersecurity is managed and who plays a role, let’s take some time to walk through key players and how they compare.
Let’s start with definitions
Here are some simple definitions for the three primary types of cybersecurity resources.
- MSP (Managed Service Provider) – This is the outsourced alternative to having employees dedicated to maintaining your technology systems, troubleshooting issues, and so forth. Optimal Networks is one of these.
- MSSP (Managed Security Service Provider) – This is another outsourced provider whose role is exclusively to provide and manage security prevention, detection, and response. Most have 24/7 human monitoring which is difficult to reproduce in-house.
- CISO (Chief Information Security Officer) – This is an executive-level role that can be provided by a full-time employee or an outsourced security consultant.
Here you might be asking yourself, doesn’t my MSP handle my security. The short answer is “yes,” to an extent. Allow us to elaborate in the next section.
With all these levels, who oversees cybersecurity?
Now that we understand the different levels of support, here is the breakdown of who manages what.
MSP
An MSP is responsible for maintaining the secure operation of your technology. They may provide SOME security services as part of overall management but do not encompass the entire range of cybersecurity. Take Optimal’s baseline technology management services which include:
- Server monitoring and management
- Workstation protection and management
- Firewall and backup management
- 24/7 helpdesk with unlimited on-site escalation
- Proactive network engineering
- Curated security awareness training program
There are security elements here, but within the context of overall technology management.
MSSP
MSSPs are a little different. They are known as a security provider and unlike an MSP, they focus solely on providing cybersecurity services. So while there is some overlap in capabilities, MSSPs provide comprehensive security offerings above and beyond what an MSP typically offers, including penetration testing and a fully-staffed Security Operations Center to intervene around the clock.
CISO
CISOs set forth an organization’s cybersecurity strategy that is then carried out by an MSP, MSSP, internal staff, or a combination of the three. They are responsible for keeping tabs on security measures and making they conform to an appropriate framework. They’ll also report performance against that framework back up to other top executives.
Do you need all 3 levels?
No, there aren’t many situations where a mid-sized organization will need all three levels of this type of support. In fact, organizations with 150 employees or fewer can generally be in good shape with a forward-looking MSP.
If, however, you have very strict compliance regulations to follow or very security-conscious clients, it might make sense for you to explore resources at the MSSP and/or CISO level.
We hope this helps clear the different roles up for you. For more cybersecurity best practices, check out our Toolkit!