MDR selection: the criteria that matter under NIS2 and DORA

Why it matters

You buy MDR so that somebody competent watches at 3am on a Sunday. Whether that somebody is a dedicated analyst who knows your environment or a shared tier-one queue working from a runbook, and whether a tier-three engineer exists on the night shift at all, decides what happens in the first hour of a real incident. The SOC's staffing is the product.

Why it matters

MDR is sold on speed, but "minutes to respond" on a website is not a commitment. What matters is three separate clocks in the contract: time to detect, time until a human has triaged and classified the alert, and time until containment has started. Each of those clocks needs a number, a severity level it applies to, and a consequence if it is missed, and the provider's historical performance tells you whether the number is real.

Why it matters

Real threat hunting is a human forming a hypothesis about your environment and searching for it in the data. Many services rebrand automated alert triage as hunting. The difference matters because the attacks that hurt are the ones the rules did not fire on, and only hunting finds those.

Why it matters

Your own team does not disappear when you buy MDR; it has to work with the provider's analysts, see what they see and take over parts of the work when it makes sense. A provider whose portal shows a list of closed tickets and nothing else turns your team into a recipient of conclusions, and under NIS2 the management body still has to oversee a measure it cannot look into.

Why it matters

The R in MDR ranges from "we send you an alert with a recommendation" to "we isolate the host, disable the account and block the hash without waiting for you", and beyond containment lies incident response proper: forensics, eradication, recovery support and the written report your regulator wants. Whether that is included, in a retainer with pre-paid hours, or billed at emergency rates when you need it most, decides the real cost of your worst day.

Why it matters

Some MDR providers monitor whatever EDR, SIEM and cloud you already run. Others only deliver their full service on their own stack and treat everything else as a log feed. The second model can mean replacing tools you bought two years ago, and it ties the exit from the service to the exit from the tooling, which doubles the switching cost DORA asks you to plan for.

Why it matters

Most MDR services grew out of an EDR product and see the world through the endpoint agent. Modern intrusions start with a stolen identity, a misconfigured cloud role or a VPN appliance, none of which run an agent. Whether the provider ingests your existing EDR and SIEM at full depth, writes detections for those sources and has analysts who actually look at them decides whether the attack is seen early or after the attacker has what they came for.

Why it matters

A growing share of what an attacker wants sits in the cloud control plane: identity roles, storage buckets, serverless functions and the audit trails that record who touched them. An MDR that watches endpoints and forwards cloud logs unread misses the misconfigured role that exposed a database, and it misses it across every cloud you run, not only the one the provider's own product supports.

Why it matters

If you run production plants, the attack that stops the business goes through the OT network, and an analyst trained on Windows process trees does not know what a suspicious Modbus write looks like. OT monitoring is passive, protocol-aware and cannot isolate a PLC the way it isolates a laptop, so the provider's OT option has to be a different service with different people, not the same SOC with another log source.

Why it matters

An MDR analyst looks at process trees, usernames, file names and sometimes file contents from your systems. Where that analyst sits matters under GDPR and, for regulated workloads, under NIS2 and DORA. A follow-the-sun model means your night shift is handled from another continent, and that is access to personal data from outside the EU, regardless of where the data is stored.

Why it matters

A SOC is a process organisation, and its maturity shows in whether procedures are documented, measured and improved or whether everything depends on the two senior analysts who might leave. SOC-CMM, a CMMI-style assessment or an equivalent independent review is the closest thing to evidence that the SOC will perform the same way in month eighteen as in the sales demo.

Why it matters

In a real incident the question is not whether the provider detects, it is who calls whom, how fast, on which number, and what happens when the first contact does not answer. NIS2 gives you 24 hours from awareness for an early warning, and the provider is the one who becomes aware first. The escalation path and the communication SLA are where that clock is won or lost.

Why it matters

A provider that shares indicators with its sector's ISAC, the national CERT and its peers sees campaigns against organisations like yours before they reach you, and it feeds what it learns from your incidents back into the community. A provider that only consumes commercial feeds knows what everyone knows, a day later.

Why it matters

Under NIS2 the management body is responsible for the cyber risk measures and must be able to oversee them; under DORA the management body is accountable for ICT third-party risk. Both need reporting they can read, and both benefit from a provider who tells them what to fix next. The quarterly review is where an MDR contract turns from a monitoring service into a security programme, or stays a page of alert counts.

Why it matters

An MDR service is not live when the contract is signed. It is live when the agents are deployed, the log sources are connected, the asset inventory is known to the analysts and the false positives from your environment have been tuned out. That period is typically weeks to months, and during it the service is partly blind while you already pay.

Why it matters

The honest comparison is not MDR against nothing, it is MDR against the SOC you would otherwise have to build: analysts in shifts, tooling, training, turnover, and the management attention it takes. Both numbers have to be built on the same scope over the same three years, otherwise the cheaper option is simply the one that left more out.

Why it matters

The provider's analysts access personal data in your telemetry every day, which makes the provider a processor under GDPR and the contract a data processing agreement with a list of sub-processors, locations and safeguards for any access from outside the EU. For a financial entity the same facts go into the DORA register of information. If the DPA is a generic annex, the residency you negotiated is not in it.

Why it matters

When the contract ends, you need your telemetry, your incident history, your detection rules and your tuning decisions, otherwise the next provider starts from zero and the audit trail of three years of incidents disappears. Under DORA an exit strategy for critical functions is mandatory; under NIS2 it is simply prudent.

Why it matters

An MDR provider is judged by the incidents it has handled, and a provider that has never worked a ransomware case in a hospital, a bank or a plant of your kind will learn on yours. References from your sector, with incidents behind them, are the only evidence that the runbooks fit your reality and that the provider survives an audit by your supervisor.

Why it matters

Your cyber insurer increasingly asks which MDR you run and what it guarantees, and some policies discount or require specific capabilities such as 24/7 monitoring and contractual response times. The provider's own certifications (ISO 27001, SOC 2) are what your supplier file and your insurer's questionnaire ask for, and a gap in either costs money at renewal or, worse, at claim time.

Why it matters

Per-endpoint pricing is easy to compare and quietly excludes identity, cloud and network coverage, which are billed as add-ons or by ingested gigabyte. Per-user pricing looks fair until service accounts and contractors are counted. A flat monthly fee looks safe until you learn what scope the flat rate assumes. Each model rewards a different behaviour, and the wrong one turns every new log source into a budget negotiation.

Why it matters

The quote assumes a normal month. The invoice that hurts comes after the abnormal one: an alert storm from a misconfigured source that counts against a volume cap, an incident that consumed forty IR hours beyond the included ten, an escalation to the provider's forensics team at emergency rates. Predictability is what the contract says about those months.

Why it matters

At the end, the decision needs one number per provider that can be compared: the quoted annual service price for the coverage you will actually buy, over the term you will actually sign. Every other criterion in this catalog feeds into how much that number is worth; this one makes sure it exists and that it is comparable.