Which network security responsibilities remain with our business?
Your business remains responsible for setting security policies, approving risk decisions and ensuring employees follow safe working practices, even when network security is managed externally. You must also control access to business data, report suspected incidents promptly and meet any legal, regulatory or contractual security obligations; the managed service provider supports the technical controls and advice agreed in the service.
Network security remains a shared responsibility: the managed service provider operates the technical controls included in the agreement, while your business remains accountable for the environment, decisions and activities that those controls are intended to protect. The exact division should be documented so that important tasks are not assumed to belong to the other party.
Define what is in scope. Your business should identify which offices, sites, network devices, remote connections, wireless networks, cloud services and third-party connections are covered by the managed service. Newly acquired equipment, temporary sites, home-working arrangements and specialist systems can otherwise sit outside the provider’s monitoring or maintenance processes. Keep the agreed scope current when your organisation changes.
Maintain an accurate business view of the environment. The provider may maintain technical network documentation, but your organisation must confirm which systems are business-critical, which departments depend on them and which dependencies would affect operations if unavailable. This context helps determine the appropriate priority for maintenance, replacement, segmentation or investigation. It also identifies equipment that is owned or controlled by another supplier.
Own decisions about acceptable risk. A provider can identify weaknesses, recommend controls and explain the technical consequences of different options. It cannot decide whether your business should accept an unsupported device, delay a disruptive change or permit an exception to a security control. Those decisions should be made by an appropriately authorised person and recorded with an owner, a reason, a review date and any compensating safeguards.
Control the wider technology estate. Network protection does not automatically secure every device or service that connects to the network. Your business should establish who is responsible for:
- laptops, desktops, mobile devices and equipment used away from managed premises;
- printers, cameras, telephony, industrial equipment and other connected devices;
- cloud applications and hosted platforms administered by another supplier;
- home-working routers and personal equipment, where their use is permitted; and
- systems belonging to contractors, visitors or business partners.
Where another party manages an asset, obtain evidence of its security arrangements and make the connection subject to defined requirements. If a device cannot support the required controls, the business should decide whether it needs isolation, restricted access, replacement or removal.
Manage suppliers and connectivity dependencies. Internet circuits, hosted services, software providers, landlords, facilities teams and outsourced applications can all affect network security. Your business should keep relevant contracts and contacts available, understand which party can make changes, and ensure that supplier agreements address security duties, incident co-operation and access to necessary information. A managed network provider cannot enforce controls on a third party unless the arrangement gives it the authority and technical access to do so.
Provide the information needed for safe technical work. The provider needs accurate details about planned office moves, new services, acquisitions, regulatory requirements, critical business dates and unusual operating constraints. Tell the provider before introducing equipment or connectivity that could affect the network. Business owners should also participate in change approval and testing where a modification could affect an important application or site.
Protect the physical and environmental conditions. Network security also depends on the places in which equipment is installed. Your organisation may remain responsible for preventing unauthorised physical access, controlling keys or entry permissions, protecting wiring and network cabinets, and maintaining suitable power, cooling and fire protection. Where premises or equipment are controlled by a landlord or another contractor, clarify those duties rather than treating them as part of remote network management.
Prepare for recovery, not only prevention. Decide which services must be restored first, how long the business can operate without them and who can authorise recovery actions. Confirm that important configurations and data are backed up under an agreed arrangement, that backups are protected from unauthorised alteration and that restoration is tested. The provider may support network configuration recovery, but business leadership must determine operational priorities and acceptable disruption.
Review evidence and assurance. Ask for the reports, records or summaries needed to assess whether the agreed controls are operating as intended. Review unresolved findings, recurring faults, exceptions, asset changes and recommendations at a suitable governance meeting. Independent testing or an audit may also be appropriate where customers, regulators, insurers or contracts require evidence. The business remains responsible for acting on findings that fall outside the provider’s remit.
A practical responsibility schedule should name each task, its owner, the required approval, the evidence retained and the circumstances that trigger a review. It should distinguish between the provider’s operation of a control and the business’s responsibility to supply accurate information, make informed decisions and manage assets outside the service boundary. S2 Technology Group can help businesses map these boundaries when reviewing managed network arrangements, so the technical service and internal governance work together without leaving gaps.
Your business must define how sensitive information should be protected; a managed network provider cannot determine the importance or legal status of your data. Identify information that requires restricted access, encryption, segregation or additional monitoring, and document any retention or location requirements that affect the network and connected services.
This classification gives the provider clear technical requirements for configuring access controls, network segments and security monitoring. Review it when a new system, application or data process is introduced, particularly where personal, financial, confidential or contractually protected information is involved. The business remains responsible for confirming that the controls match its obligations and for approving any exception.
