Your MSSP runs endpoint triage collection with its own tooling and a 90-day retention - what do you settle before the next incident?

## Why the obvious answer is the wrong one Faced with `their retention is 90 days and litigation runs for years`, the reflex is to renegotiate retention upward. It is a bad trade. Long retention prices in on **every** collection from **every** host forever, while the collections that actually need multi-year preservation are a tiny fraction - the ones attached to a case that turns legal. You would be buying an expensive insurance policy against a cheap, targeted alternative: move the few collections that matter into your own custody early. That reframing is the substance of this question. It is a budget and ownership decision, and it is why it lands with whoever owns the provider relationship rather than with the responder on the case. ## What to actually contract **1. Raw artefacts, not just conclusions.** The most consequential clause. Many co-managed arrangements deliver the provider's *parsed and normalised* output - a timeline, a findings report, a table of processes. That is a derived work of the evidence, not the evidence. When a new question appears six months later, you cannot re-parse a report. Insist that the original collection archives are available, and that `available` includes after the engagement ends. **2. Integrity metadata with every delivery.** Hashes computed at collection, plus a manifest naming the collection tool and version, the profile version, the host, and the collection timestamps. Without the manifest you cannot later explain what was and was not collected, which is precisely the question a triage set attracts. **3. Transfer on demand, with a clock.** A defined SLA for delivering collections into your store - hours for a live case, not `best efforts`. And a standing arrangement that anything attached to a flagged case transfers immediately, so the 90-day retention becomes irrelevant for the material that matters. **4. Whose profile is it.** Agree that you own the artefact profile and can change it, that the provider will tell you when their tooling changes what it collects, and that you can push a case-specific extension without a change-request cycle. A profile you cannot alter is a visibility ceiling set by someone else. **5. Authorisation and sensitive populations.** Who inside the provider may initiate a sweep of your estate, and who inside yours must approve one. Collections from executive, legal or HR machines usually need a named internal approver and sometimes counsel involvement - agree the route before the night you need it. **6. Exit.** On termination you receive the evidence archive in a documented format within a defined period, and their copies are destroyed with a certificate. Exit clauses are boring until they are the only thing standing between you and evidence you cannot get back. ## The operational terms that sit alongside - **Reach and speed.** How many hosts can they collect from concurrently, and how long does a full-estate sweep take? Test it in a drill, because a number in a contract is not a measurement. - **Two retention clocks.** Their raw endpoint telemetry retention and their collection retention are different from your evidence retention. Write down all three, and know which one bounds any given question. - **Their tooling, your comprehension.** If their collector produces a proprietary container, make sure someone on your side, or an external examiner you might retain, can open it. Format lock-in is a custody problem in slow motion. - **Jurisdiction and location.** Where the collections physically sit affects both privacy obligations and who can compel them. ## The residual risk you knowingly accept Under this design the gap is the period between a collection being taken and someone flagging its case as retention-worthy. If nobody flags within 90 days, the collection is gone. You manage that with a cheap, liberal flagging rule - any case that touched personal data, an employee as subject, a customer commitment or plausible litigation gets flagged at open, not at close - because flagging is nearly free and un-flagging is trivial, while retrieval after deletion is impossible. That is the classic asymmetry argument, and stating it is what shows you have thought past the contract clause into how it fails. ## How to present this internally Security does not usually own the provider commercials. The persuasive framing is not `forensics needs more`, it is a cost comparison: universal multi-year retention across the estate versus targeted transfer of a small number of case-attached collections, with the second costing a fraction and covering the same legal exposure. Bring the number of cases per year that actually needed preservation. That is the conversation that gets the clause into the renewal.