Customer boundaries come first
Managed security work must preserve the customer and approved organization scope in every alert, search, investigation, report, and supported response. Evidence, ownership, service targets, retention, and authorization should never be inferred from another customer’s workflow.
Operate consistently without flattening customers
- Use consistent triage and investigation practices while respecting each customer's priorities, escalation contacts and permissions.
- Keep queue ownership, waiting reasons, and service targets clear for every customer record.
- Review source health and evidence freshness separately for each customer environment.
- Use retained reports and outcomes that state customer scope, evidence period, coverage, and responsible team.
- Require the exact customer approval and supported provider capability before response.
Review service quality
- Coverage and freshness by customer and source
- Alert pressure, ownership, waiting state, and service-target risk
- Investigation quality, supported dispositions, unknowns, and reopened work
- Detection feedback and improvement work tied to verified customer outcomes
- Approved response completion, failure, rollback, and residual risk