Managed Security Services: How to Compare UAE Provider Proposals

A UAE company receives two bids to monitor its systems around the clock. Both include a security operations centre. One provider will investigate alerts from the company’s email and devices, then call the duty manager for approval before taking action. The other can isolate certain devices under a signed procedure, but its base proposal excludes the cloud identity logs that would reveal some account attacks. The apparent comparison between two monthly fees conceals different coverage and response options.

Ask each provider to work from the same systems and incident scenarios. Verify what it can see, what its analysts will do and when a person at your company must make a decision. The strongest proposal for your business should be the one whose coverage, authority and cost you can explain and test.

Build the comparison around the systems at risk

Give bidders a list of the systems and sites to cover. Include email and identity, laptops and servers, cloud accounts, internet-facing services and remote access. Note which applications handle payments or sensitive records and whether they use separate accounts. A UAE business with several legal entities or outsourced operations may need to identify which environments each provider is permitted to access.

Ask for a coverage sheet that names the data source, the events collected, the collection method, retention and responsibility for restoring a broken feed. A device agent might report suspicious activity from laptops while the provider has no access to sign-in logs for the company’s cloud applications. A firewall feed can show a connection without identifying which user approved a change. Each relevant scenario needs a source that can supply the facts the analyst needs.

Check both the eligible estate and the live coverage. For example, suppose a hypothetical company has 200 supported devices and 190 are sending usable events. That gives 95% coverage for devices in scope. If the missing ten include finance workstations and an administrator's laptop, the average hides an important exposure. Ask for a named exception list and a test that verifies missing or stale feeds are noticed.

Separate detection from authority to intervene

Ask what the provider means by managed detection and response, monitoring or security operations. Some offers focus on receiving events and notifying a contact. Others include investigation, recommendation and containment. Test a familiar scenario, such as a new email forwarding rule after a suspicious login, and ask the provider to walk through detection, triage, contact and any action it can take.

Agree which actions the provider may perform without waiting. It might isolate a named laptop while a server that runs dispatch requires approval from the business owner. Document the permitted systems, triggers, time limits and way to reverse an action. Give the provider an alternate approver and specify what it should do if nobody answers. Check the agreement against the capabilities of the actual tool. A contractual right to isolate a device has limited value if the provider does not have access to that device.

A joint cybersecurity advisory published by CISA discusses monitoring and logging for managed service providers and visibility for their customers. Use it to ask what evidence the provider can give the buyer about activity in its own environment and about the provider's access to it. The advisory is a technical reference for the purchase. The buyer still needs to decide what logs and retention are appropriate for the UAE service and its requirements. Joint advisory on managed service provider security

Inspect the provider’s own access to the customer environment. Ask for named accounts, narrowly scoped roles and a way to verify what an analyst or automated service did. Test revoking a provider account and see how quickly the change takes effect. Where an analyst can open sensitive logs, agree how access is approved and recorded. Ask who responds if the provider itself reports a security incident, how the buyer can restrict access without losing all visibility and which records the provider can make available during the investigation.

Check credentials and what the certification covers

Identify the company providing the service, where its analysts operate and any subcontractors involved. Ask for the scope and validity of certificates used in the proposal. A certificate for a different entity, location or service may not cover the team handling your environment. Where the provider shows experience in a similar sector, ask what responsibilities it held and which work was retained by the customer. A client logo alone cannot answer either question.

The Dubai Electronic Security Center's certification page describes its Security Operations Centre Security Standard and states that compliance is mandatory for SOC providers wishing to offer SOC services to Dubai government and semi-government entities. Determine which requirements apply to the actual buyer and procurement, and verify a bidder's claimed certification and scope with the relevant records. Treat that check as distinct from testing the service it has proposed. Dubai Electronic Security Center certifications

A UAE Ministry of Finance carousel illustrates supplier registration on the federal procurement platform. Registration, certification and service acceptance are distinct questions. For this purchase, keep the evidence for each question with the appropriate scope and awarding or issuing organization.

Run a controlled test of the proposed service

Use an approved test account and device. Agree what the exercise can touch and who can stop it. Introduce a scenario, then capture when the event occurred, when the provider received it, when an analyst investigated and when the buyer was notified. Have staff follow the real approval route for any containment step. Ask what changes outside normal business hours and repeat the contact exercise where that matters.

Suppose a test event occurs at 20:00. The provider receives it at 20:07, an analyst confirms the scenario at 20:24 and the duty manager receives the call at 20:35. The overall time to notify is 35 minutes. The time from confirmation to notice is 11 minutes. If a proposal promises a call within 15 minutes after confirmation, the example meets that promise while still taking 35 minutes from the event. If the business needs action within 30 minutes of occurrence, the scope and clock need further review.

Add a test that removes a feed. An analyst cannot investigate activity it never receives, so the company needs a way to notice loss of visibility. Check which party can restore the feed, how the gap is recorded and whether relevant events can be recovered. Add a benign event that looks suspicious and ask the provider to explain its reasoning. That helps the buyer see whether the service can distinguish activity that merits interruption from activity that needs context.

Request an example incident record. Look for the affected assets, timeline, confidence, evidence references, action taken and any decision left with the buyer. Confirm whether your team can retrieve it directly and whether timestamps use a common time zone. If the provider can send an alert but only the customer can inspect the original event, test that access before an incident.

Keep a note of how the test was arranged. A scripted demonstration can show that the tools and procedures exist, while a controlled exercise with the duty team can reveal whether the real contact and approval route works. Record any step the vendor prepared in advance and repeat that step with the proposed operating team where it matters. Use the same scenario and start point for each bidder. Compare the evidence each one could retrieve and the decision it could support as well as the elapsed time.

Price the capacity to investigate and respond

Use the same inventory and expected data volumes for each bidder. Ask which fees are driven by endpoints, users, events or storage, and which investigations are included. Determine whether onboarding, custom detections, log retention, response hours and recovery work carry separate charges. Ask what happens when a major incident creates more work than the base service includes. A low fee can be appropriate for a narrow scope if the company has people to handle the excluded work.

Check what the company will need to provide on every shift. Analysts may need a customer contact to explain whether an action was expected, authorize containment or reach another vendor. Identify those people and account for their time. Ask for a rate or escalation route for services beyond the monthly agreement, such as detailed forensic work. Put any third-party service or tool license into the same comparison.

Ask who owns detection changes and case records. A provider may retain its own methods and tools while agreeing to export customer cases and evidence. Test the format and see whether another team can match case references to the original logs. Set the terms for retaining or deleting data, handing over open cases and removing the provider's privileges at exit. Give the customer an independent way to confirm that the old accounts and integrations were disabled.

Make the acceptance decision explicit

Have the decision maker review the signed scope alongside the tested coverage and the response exercise. Identify which risks still sit with the buyer. If a missing identity feed would prevent the service from investigating a scenario the buyer considers critical, make successful integration an acceptance condition. If the provider cannot intervene on a critical system, confirm that a customer contact can take the action within the required period.

Set a named owner for coverage changes after onboarding. A new cloud account, branch or set of workstations can go live before anyone checks whether it feeds the provider. Require an owner to verify monitoring and authorization when a system is added, and document the process for removing systems that no longer belong in scope.

After onboarding, review the source inventory, any blind spots, the quality of incident records and how often the buyer had to act. Have the provider explain how it counts open investigations and which are awaiting a decision from the buyer. Check the first bill against the proposal and investigate changes in event volume or support charges. Repeat a controlled detection and response exercise after a major change to the estate or service. The company should be able to show which signals the provider sees, what happens when one matters and who is accountable when the response crosses organizations.