Does your organization have formal agreements in place with third-party security providers to perform incident eradication actions on your behalf?

Third-party security providers (such as Managed Security Service Providers) can offer specialized expertise and resources for eradicating security incidents that may exceed internal capabilities. These arrangements should clearly define the scope of authority, procedures, and communication protocols for when and how third parties can take eradication actions within your environment. Evidence of fulfillment could include signed service level agreements (SLAs) with security service providers, documented incident response procedures that specify third-party roles and responsibilities, or authorization matrices showing which third parties have permission to perform specific eradication actions in your systems.