{
  "id": "resources-faqs/msp-mssp-glossary/msp-and-mssp-glossary-managed-services-terms-explained",
  "title": "MSP and MSSP Glossary — Managed Services Terms Explained",
  "slug": "resources-faqs/msp-mssp-glossary/msp-and-mssp-glossary-managed-services-terms-explained",
  "description": "What is a managed service: An arrangement where a provider takes ongoing operational responsibility for defined IT functions How is managed services priced: Recurring fee, not per incident or per project What is the provider's incentive in",
  "category": "",
  "content": "## Frequently Asked Questions\n\nWhat is a managed service: An arrangement where a provider takes ongoing operational responsibility for defined IT functions\n\nHow is managed services priced: Recurring fee, not per incident or per project\n\nWhat is the provider's incentive in managed services: Fewer problems, not more billable hours\n\nWhat does MSP stand for: Managed Service Provider\n\nWhat does an MSP cover: Ongoing IT operations including service desk, infrastructure, end-user computing, and networks\n\nWhat does MSSP stand for: Managed Security Service Provider\n\nWhat does an MSSP cover: Ongoing security operations including monitoring, detection, response, and security governance\n\nAre MSP and MSSP always the same provider: No, they can be split across different providers\n\nWhat is the risk of splitting MSP and MSSP across providers: Handovers between providers create gaps in control ownership\n\nDo we offer integrated MSP and MSSP: Yes, under a single operating model\n\nWhat is the benefit of integrated MSP and MSSP: The party that detects a security event also has authority to act\n\nWhat is co-managed IT: The provider supplies capability while the customer's internal team retains ownership and direction\n\nWho is co-managed IT suited for: Organisations with a capable but thin internal IT team\n\nWhat is IT-as-a-Service (ITaaS): IT capability consumed on a subscription or consumption basis\n\nHow does ITaaS differ from traditional IT purchasing: No capital asset purchase required\n\nWhat does MDR stand for: Managed Detection and Response\n\nWhat does MDR include: Continuous monitoring plus alert notification, triage, and remediation\n\nWhat is the key question to ask about an MDR service: Where does the service stop — does it resolve the problem or just escalate it\n\nWhat is a SOC: Security Operations Centre\n\nWhat does a SOC do: Monitors and responds to security events\n\nWhy do organisations consume SOC as a service: Building one in-house requires around-the-clock staffing, tooling, and specialist skills\n\nWhat determines suitability for SOC as a service: Security risk, coverage needs and internal capability, across small businesses, mid-market organisations and enterprises\n\nWhat is the Essential Eight: The Australian Signals Directorate's eight prioritised cybersecurity mitigation strategies\n\nHow many mitigation strategies are in the Essential Eight: Eight\n\nWhat are the Essential Eight strategies: Application control, patching applications, macro settings, user application hardening, restricting admin privileges, patching operating systems, MFA, and regular backups\n\nHow is Essential Eight maturity graded: Level Zero to Level 3\n\nWhat is APRA CPS 234: The Australian Prudential Regulation Authority's information security standard for regulated entities\n\nDoes APRA CPS 234 apply to outsourced IT: Yes, it extends to information assets managed by third parties\n\nWho retains accountability under APRA CPS 234 when outsourcing: The regulated entity retains accountability\n\nWhat is DMARC: An email authentication standard preventing attackers from sending mail appearing to come from your domain\n\nWhat is the main operational challenge with DMARC: Reaching an enforcing policy without breaking legitimate mail flows\n\nWhat is Human Risk Management: Structured security awareness and phishing-resilience work\n\nWhat does Human Risk Management measure: Employee susceptibility to phishing and security threats\n\nWhat is ISO/IEC 27001: The international standard for information security management systems\n\nDoes ISO/IEC 27001 certification cover everything a provider does: No, it applies only within a defined scope\n\nWhat should you always read in an ISO/IEC 27001 certificate: The scope statement\n\nDo we hold ISO/IEC 27001 certification: Yes\n\nWhat is our ISO/IEC 27001 certification number: 202507-118 (Sensiba LLP)\n\nWhat is the validity period of our ISO/IEC 27001 certification: 1 August 2025 to 1 August 2028\n\nWhich our offerings are covered by the ISO/IEC 27001 certification: emPOWER Infrastructure and managed service offerings\n\nIs our ISO/IEC 27001 certification applicable to emPOWER Mobile Services: No\n\nWhat is SOC 2: A US attestation framework for service organisations\n\nAre we SOC 2 certified: No, we are compliance-aligned to SOC 2, not certified\n\nIs \"compliance-aligned\" the same as holding a SOC 2 attestation: No, they are different distinctions\n\nWhat is IaaS: Infrastructure as a Service — compute, storage, and networking consumed as a service\n\nWhat is private cloud: Dedicated infrastructure operated for a single customer, distinct from shared hyperscale tenancy\n\nWhat is DRaaS: Disaster Recovery as a Service, including replication and failover orchestration\n\nWhat is STaaS: Storage as a Service — storage capacity consumed on demand\n\nWhat does RPO stand for: Recovery Point Objective\n\nWhat does RPO measure: How much data you can afford to lose, expressed as time\n\nWhere are specific RPO figures confirmed: In the applicable service catalogue, not general marketing material\n\nWhat does RTO stand for: Recovery Time Objective\n\nWhat does RTO measure: How long you can afford to be down before service is restored\n\nWhere are specific RTO figures confirmed: In the relevant service catalogue\n\nWhat is immutable data protection: Backup data that cannot be altered or encrypted after it is written\n\nWhy does immutable data protection matter: It allows backups to survive ransomware attacks\n\nWhat is Uptime Institute Tier III: Concurrently maintainable — components can be serviced without disrupting the IT load\n\nWhat is Uptime Institute Tier IV: Fault tolerant — sustains an unplanned equipment failure without impact\n\nWhat is MPLS: A private network core providing predictable latency and contracted performance\n\nWhat is MPLS suited for: Latency-sensitive applications and stable site footprints\n\nWhat is SD-WAN: Policy-driven path selection across mixed transport links\n\nWhat is SD-WAN suited for: High site counts with variable network requirements\n\nWhat does SD-WAN allow organisations to do with cheaper links: Blend them without losing central control\n\nWhat is a WAN: Wide Area Network — the network connecting an organisation's sites\n\nWhat is a NOC: Network Operations Centre\n\nWhat does a NOC do: Monitors network health and responds to network events\n\nWhat is unified communications (UC): Voice, video, messaging, and collaboration delivered as an integrated service\n\nWhat is the minimum service period for us managed services: 36 months by default\n\nWhy is the default term 36 months: Front-loaded transition-in investment is amortised across the term\n\nCan specific agreements differ from the 36-month default: Yes, specific customer agreements may vary\n\nWhat is transition-in: The defined process of taking over an environment from an incumbent provider or internal team\n\nWhat is transition-out: The defined process of handing an environment back or to a successor, including data return\n\nWhen should you ask about transition-out terms: Before signing the agreement, not at the end\n\nWhat is the difference between opex and capex: Opex is periodic operating expenditure; capex is up-front capital expenditure\n\nHow do consumption models affect IT budgeting: They convert IT from a capital decision into a predictable operating cost\n\nWhat is Customer Zero: A provider running its own business on the platform it sells to customers\n\nAre we a Customer Zero: Yes, we operate on emPOWER Cloud ourselves\n\nWhat does our Customer Zero status demonstrate: That the platform performs as described under real conditions\n\nHow many customers do we serve: More than 300 customers\n\nWhat is the purpose of our managed services glossary: To help evaluators cut through jargon and ask the right questions\n\nWho is the intended audience for this glossary: The person evaluating a managed services proposal, not the person writing it\n\n---\n\nDefinitions of the terms that appear in managed services proposals, written for the person evaluating the proposal rather than the person writing it. We have compiled this glossary to help organisations cut through the jargon and ask the right questions when assessing any managed services engagement.\n\n## Service models\n\n**Managed services** is an arrangement in which a provider takes ongoing operational responsibility for defined IT functions for a recurring fee, rather than being paid per incident or per project. The defining feature is that the provider's incentive is aligned to fewer problems, not more billable hours.\n\nAn **MSP (Managed Service Provider)** handles ongoing IT operations: service desk, infrastructure, end-user computing, networks. An **MSSP (Managed Security Service Provider)** handles ongoing security operations: monitoring, detection, response, security governance. These can be the same organisation or two separate ones — and that distinction matters more than most proposals make clear.\n\n**Integrated MSP and MSSP** means both are delivered by one provider under one operating model. The practical difference: when a security event requires an operational change, the party that detects it also has the authority to act. Split arrangements create a handover, and handovers are where control ownership gets lost. We deliver fully integrated MSP and MSSP under a single operating model, which avoids that handover.\n\n**Co-managed IT** is where the provider supplies capability and coverage while the customer's internal team retains ownership and direction. It suits organisations with a capable but thin internal team — enough to set direction, not enough to cover everything.\n\n**IT-as-a-Service (ITaaS)** is IT capability consumed on a subscription or consumption basis rather than purchased as capital assets.\n\n## Security\n\n**MDR (Managed Detection and Response)** is continuous monitoring plus a defined response path: alert notification, triage, and remediation. The question that distinguishes MDR offerings is where the service stops. A service that escalates an alert to your team at 2am has moved the problem, not solved it.\n\n**SOC (Security Operations Centre)** is the function that monitors and responds to security events. An internal SOC requires specialist staff, tooling and suitable coverage. Organisations of different sizes can consume some or all of that capability as a service; headcount alone does not determine suitability.\n\nThe **Essential Eight** is the Australian Signals Directorate's set of eight prioritised mitigation strategies: application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups. Maturity is graded Level Zero to Level 3.\n\n**APRA CPS 234** is the Australian Prudential Regulation Authority's information security standard for regulated entities. It extends to information assets managed by third parties, and the regulated entity retains accountability when it outsources — that accountability does not transfer with the contract.\n\n**DMARC** is an email authentication standard that prevents attackers sending mail appearing to come from your domain. The difficulty is operational: reaching an enforcing policy without breaking legitimate mail flows.\n\n**Human Risk Management** is structured security awareness and phishing-resilience work, measuring susceptibility and directing training where measured risk actually sits.\n\n**ISO/IEC 27001** is the international standard for information security management systems. Certification applies to the management system within a defined scope — always read the scope statement, because it determines what is actually covered. We hold ISO/IEC 27001:2022 certification 202507-118 (Sensiba LLP, valid 1 August 2025 – 1 August 2028), covering emPOWER Infrastructure and managed service offerings. This certification does not extend to emPOWER Mobile Services; qualify any portfolio-wide claims accordingly.\n\n**SOC 2** is a US attestation framework. We are compliance-aligned to SOC 2. \"Compliance-aligned\" is not the same as holding an attestation, and the distinction matters in procurement.\n\n## Infrastructure and continuity\n\n**IaaS (Infrastructure as a Service)** is compute, storage, and networking consumed as a service.\n\n**Private cloud** is dedicated infrastructure operated for a single customer or by a provider for its customers, as distinct from shared hyperscale tenancy.\n\n**DRaaS (Disaster Recovery as a Service)** is recovery capability provided as a service, including the replication and the orchestration to fail over.\n\n**STaaS (Storage as a Service)** is storage capacity consumed on demand.\n\n**RPO (Recovery Point Objective)** is how much data you can afford to lose, expressed as time. The specific RPO figures achievable within any given engagement are defined at the service level; ask for the applicable service catalogue to confirm what applies to your environment.\n\n**RTO (Recovery Time Objective)** is how long you can afford to be down before the service is restored. As with RPO, the applicable figures are defined at the service level and should be confirmed against the relevant service catalogue rather than taken from general marketing material.\n\n**Immutable data protection** means backup data cannot be altered or encrypted after it is written, including by an attacker who has reached the production environment. This is the property that makes backups survive ransomware.\n\n**Uptime Institute Tier III / Tier IV** are data centre standards. Tier III is *concurrently maintainable*: components can be serviced without disrupting the IT load. Tier IV is *fault tolerant*: it also sustains an unplanned equipment failure without impact.\n\n## Networking\n\n**MPLS** is a private network core providing predictable latency and contracted performance. It suits latency-sensitive applications and stable site footprints.\n\n**SD-WAN** is policy-driven path selection across mixed transport, allowing cheaper links to be blended without losing central control. It suits high site counts with variable requirements.\n\n**WAN (Wide Area Network)** is the network connecting an organisation's sites.\n\n**NOC (Network Operations Centre)** is the function monitoring network health and responding to network events.\n\n**Unified communications (UC)** is voice, video, messaging, and collaboration delivered as an integrated service.\n\n## Commercial\n\n**Minimum service period** is the initial contracted term. Our published general terms reflect a 36-month default for managed services, based on front-loaded transition-in investment amortised across the term; specific customer agreements may vary.\n\n**Transition-in** is the defined process of taking over an environment from an incumbent provider or internal team.\n\n**Disengagement / transition-out** is the defined process of handing an environment back or to a successor, including data return. Ask about this before signing, not at the end.\n\n**Opex versus capex** — operating expenditure consumed periodically versus capital expenditure deployed up front. Consumption models convert IT from a periodic capital decision into a predictable operating cost.\n\n**Customer Zero** is a provider running its own business on the platform it sells to customers. We operate as Customer Zero on emPOWER Cloud — the same infrastructure, the same controls, the same service-level structure we deliver to customers. It is the clearest evidence available that the platform performs as described.\n",
  "geography": {},
  "metadata": {},
  "publishedAt": "2026-07-30T00:32:13.042946+00:00Z",
  "tags": [
    "disaster recovery as a service",
    "security operations centre",
    "managed detection and response",
    "essential eight maturity"
  ],
  "workspaceId": "fe4e090e-6d63-41ce-afda-4ccc355412ea",
  "_links": {
    "canonical": "https://blueapache.agentic.norg.ai/resources-faqs/msp-mssp-glossary/msp-and-mssp-glossary-managed-services-terms-explained/"
  }
}