[{"data":1,"prerenderedAt":416},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"cmp-\u002Fen\u002Fcomparisons\u002Fmsp-vs-mssp-vs-vciso-vs-in-house":45,"cmp-alt-\u002Fen\u002Fcomparisons\u002Fmsp-vs-mssp-vs-vciso-vs-in-house":401,"cmp-others-\u002Fen\u002Fcomparisons\u002Fmsp-vs-mssp-vs-vciso-vs-in-house":403},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"criteria":233,"date":290,"description":291,"extension":292,"faq":293,"keyword":306,"meta":307,"navigation":308,"options":309,"path":365,"rawbody":366,"seo":367,"sources":368,"stem":386,"translationKey":387,"updated":388,"verdict":389,"verified":399,"__hash__":400},"comparisons_en\u002Fen\u002Fcomparisons\u002Fmsp-vs-mssp-vs-vciso-vs-in-house.md","MSP vs MSSP vs vCISO vs In-House: Who Should Run Security?",{"type":49,"value":50,"toc":225},"minimark",[51,55,58,79,84,92,98,105,111,115,118,127,135,139,142,146,172,180,184,187,214,221],[52,53,54],"p",{},"Ask a small business who looks after cybersecurity and you'll often get a vague answer: \"our IT guy,\" \"our provider,\" \"we have antivirus.\" That's not a criticism. According to a 2023 KPMG survey, 65% of Quebec small and medium businesses don't have qualified staff to manage cyber risk.",[52,56,57],{},"There are four models to choose from: a managed IT service provider (MSP), a managed security service provider (MSSP), a virtual CISO (vCISO) and in-house staff. They don't do the same job, and most businesses end up combining two of them.",[59,60,63],"callout",{"title":61,"type":62},"Our method","info",[64,65,66,70,73,76],"ul",{},[67,68,69],"li",{},"We compare operating models, not providers. The criteria draw on publications from the Canadian Centre for Cyber Security, CISA, the UK's NCSC and NIST, reviewed in October 2026.",[67,71,72],{},"Criteria: role, 24\u002F7 monitoring, patching, governance, privileged access, independence, accountability, contract requirements and continuity.",[67,74,75],{},"Cost models are described qualitatively: rates vary too much with size and scope to publish reliable figures.",[67,77,78],{},"This comparison is not sponsored.",[80,81,83],"h2",{"id":82},"four-roles-not-four-versions-of-one-service","Four roles, not four versions of one service",[52,85,86,87,91],{},"An ",[88,89,90],"strong",{},"MSP"," runs your IT: it applies patches, manages accounts, watches backups and answers support calls. Security is part of its job to the extent the contract says so.",[52,93,86,94,97],{},[88,95,96],{},"MSSP",", or an MDR service, watches. The UK's NCSC describes a security operations centre's role as limiting damage by detecting and responding to attacks that get past your preventive controls. This is the service that reacts at 3 a.m.",[52,99,100,101,104],{},"A ",[88,102,103],{},"vCISO"," governs. The Canadian Centre for Cyber Security recommends that every organization name someone in a leadership role who is specifically responsible for IT security. A vCISO doesn't replace that person: it equips them, sets priorities, writes policies and makes sure the plan moves forward.",[52,106,107,110],{},[88,108,109],{},"In-house staff"," know the business better than anyone. The limit is simple arithmetic: one person can't cover nights, weekends or their own vacations.",[80,112,114],{"id":113},"what-outsourcing-doesnt-transfer","What outsourcing doesn't transfer",[52,116,117],{},"Outsourcing the work doesn't outsource the responsibility. The Canadian Centre for Cyber Security is explicit: the organization remains accountable for incident response, even when the provider carries out part of it. It also recommends that the service agreement set out response times, communication channels and the escalation process.",[52,119,120,121,126],{},"The provider is itself a risk. MSPs are prime targets because their privileged access opens the door to many clients at once. An advisory from CISA and its partners, including the Canadian Centre, recommends requiring by contract multi-factor authentication on every provider account, retention of key logs for at least six months, and removal of the provider's access when the contract ends. Our guide on how to ",[122,123,125],"a",{"href":124},"\u002Fen\u002Fblog\u002Fevaluate-it-provider-security","evaluate your IT provider's security"," lists the questions to ask.",[52,128,129,130,134],{},"Finally, under Quebec's Law 25, the ",[122,131,133],{"href":132},"\u002Fen\u002Fblog\u002Fprivacy-officer-quebec-security-role","privacy officer"," is by default the person with the highest authority in the business. No provider takes on that role for you without a written delegation; confirm those choices with legal counsel.",[80,136,138],{"id":137},"independence-the-common-blind-spot","Independence: the common blind spot",[52,140,141],{},"When the same provider configures your systems, monitors them and tells you everything is fine, nobody is checking its work. It's not a question of honesty: it's hard to objectively assess what you set up yourself. A vCISO separate from the MSP, or a periodic independent audit, fills that gap.",[80,143,145],{"id":144},"the-most-common-combinations","The most common combinations",[64,147,148,154,160,166],{},[67,149,150,153],{},[88,151,152],{},"MSP alone, with a periodic audit",": the starting point for small businesses.",[67,155,156,159],{},[88,157,158],{},"MSP plus MSSP",": operations by day, monitoring around the clock.",[67,161,162,165],{},[88,163,164],{},"MSP plus vCISO",": when clients, an insurer or a program such as CPCSC set specific requirements.",[67,167,168,171],{},[88,169,170],{},"In-house staff plus MSSP",": the employee keeps hands-on control, and the MSSP covers the hours they're away.",[52,173,174,175,179],{},"Whatever the mix, your ",[122,176,178],{"href":177},"\u002Fen\u002Fblog\u002Fincident-response-plan-template-small-business","incident response plan"," should spell out who calls whom, and who is allowed to isolate a workstation or cut off access.",[80,181,183],{"id":182},"how-to-choose","How to choose",[52,185,186],{},"Answer four questions honestly:",[188,189,190,196,202,208],"ol",{},[67,191,192,195],{},[88,193,194],{},"Who applies patches today, and how quickly?"," If nobody can answer, start with an MSP or an in-house hire.",[67,197,198,201],{},[88,199,200],{},"Who would see an alert at 3 a.m. on a Sunday?"," If the answer is \"nobody,\" you need an MSSP or MDR service.",[67,203,204,207],{},[88,205,206],{},"Who fills out insurer and client questionnaires?"," If it's leadership, alone and unsupported, a vCISO lightens the load.",[67,209,210,213],{},[88,211,212],{},"Who checks the provider's work?"," If nobody does, plan for an independent review.",[52,215,216,217,220],{},"Our ",[122,218,219],{"href":25},"ongoing security partner"," service acts as a vCISO for small businesses, working alongside their existing IT provider.",[222,223],"cta",{"variant":224},"devis",{"title":226,"searchDepth":11,"depth":15,"links":227},"",[228,229,230,231,232],{"id":82,"depth":11,"text":83},{"id":113,"depth":11,"text":114},{"id":137,"depth":11,"text":138},{"id":144,"depth":11,"text":145},{"id":182,"depth":11,"text":183},[234,241,248,254,259,265,272,277,284],{"label":235,"values":236},"Main role",[237,238,239,240],"Daily IT operations","Monitoring, detection and response","Governance, priorities and compliance","Depends on the profile: operations, security or both",{"label":242,"values":243},"24\u002F7 alert monitoring",[244,245,246,247],"Depends on the contract","Often offered; confirm in the contract","No","No, unless there's a full team",{"label":249,"values":250},"Patching and hardening",[251,244,252,253],"Yes, core of the mandate","No: sets the requirements","Yes",{"label":255,"values":256},"Policies, response plan and roadmap",[244,257,251,258],"Partial: alert response procedures","Depends on the person's expertise",{"label":260,"values":261},"Privileged access to your systems",[262,263,264,253],"Yes, broad","Yes, to security tools","Limited",{"label":266,"values":267},"Independence from IT operations",[268,269,270,271],"Low: it would be assessing its own work","Medium","High if separate from the MSP","Low",{"label":273,"values":274},"Accountability for incidents",[275,275,276,276],"Stays with the business; roles set in the contract","Stays with the business",{"label":278,"values":279},"What to require in writing",[280,281,282,283],"MFA on its accounts, least privilege, logs kept at least 6 months","Monitored scope, notification times, authorized actions","Deliverables, check-in frequency, availability during incidents","Job description and backup plan",{"label":285,"values":286},"Coverage during absences",[287,287,288,289],"Yes (team)","Partial","No, unless backup is planned","2026-10-24","MSP, MSSP, vCISO or an in-house hire: roles, 24\u002F7 monitoring, independence and cost models compared to decide who runs cybersecurity at your small business.","md",[294,297,300,303],{"q":295,"a":296},"Does my IT provider automatically handle cybersecurity?","Not necessarily. Some contracts cover support and maintenance without alert monitoring, backup testing or an incident response plan. Reread yours and ask in writing what's included. CISA recommends that contracts state whether the provider or the customer owns hardening, detection and incident response.",{"q":298,"a":299},"What's the difference between an MSSP and an MDR service?","The terms overlap. An MSSP generally offers a range of managed security services, such as firewall management or log monitoring. An MDR (managed detection and response) service focuses on detecting attacks and responding, for instance by isolating a compromised workstation. Read the contract: the authorized actions and response times matter more than the label.",{"q":301,"a":302},"Who's responsible for an incident if IT is outsourced?","Your business. The Canadian Centre for Cyber Security points out that the organization remains accountable for incident response, even when the provider carries out part of it. Under Quebec's Law 25, it's also the business that must notify the Commission d'accès à l'information and affected individuals when there's a risk of serious injury. Confirm how roles are split with legal counsel.",{"q":304,"a":305},"Can a vCISO be our privacy officer under Law 25?","Law 25 assigns that role by default to the person with the highest authority in the business, who can delegate it in writing. A vCISO can certainly support that person on the security side. Handing the function itself to an outside person raises questions to check with legal counsel.","MSP vs MSSP",{},true,[310,324,338,352],{"name":311,"url":312,"tagline":313,"pricing":314,"bestFor":315,"pros":316,"cons":320},"Managed IT service provider (MSP)","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fcyber-security-considerations-consumers-managed-services-itsm50030","Your outsourced IT: workstations, servers, accounts, backups and day-to-day support.","On request; usually a monthly fee per user or per device","Businesses with no in-house IT that first need well-run IT.",[317,318,319],"Covers daily operations: patching, accounts, backups","Predictable monthly cost","A team rather than one person",[321,322,323],"Security isn't always in the contract","Its privileged access to your systems makes it a target for attackers","Hard for it to assess its own work objectively",{"name":325,"url":326,"tagline":327,"pricing":328,"bestFor":329,"pros":330,"cons":334},"Managed security service provider (MSSP \u002F MDR)","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Fbuilding-a-security-operations-centre","A security team that watches your alerts, detects attacks and responds, often around the clock.","On request; usually a monthly subscription per device or per user","Businesses that have tools (EDR, logs) but nobody watching alerts at night and on weekends.",[331,332,333],"Monitoring beyond office hours","Specialized detection and response expertise","Shares a cost a small business couldn't carry alone",[335,336,337],"Doesn't always fix things itself: someone still has to act","Scope varies widely from one contract to the next","Doesn't set priorities or governance",{"name":339,"url":340,"tagline":341,"pricing":342,"bestFor":343,"pros":344,"cons":348},"Virtual CISO (vCISO)","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fbaseline-cyber-security-controls-small-and-medium-organizations","A part-time security lead who sets priorities, writes policies and keeps the plan on track.","On request; usually a monthly retainer or a block of hours","Businesses facing client, insurer or framework requirements (Law 25, CPCSC, ISO 27001) without the budget for a full-time CISO.",[345,346,347],"Governance and a roadmap without a full-time salary","Independent view of the IT provider's work","Help with insurer and client questionnaires",[349,350,351],"Doesn't handle daily operations","Availability shared across several clients","Only effective if leadership is engaged",{"name":109,"url":353,"tagline":354,"pricing":355,"bestFor":356,"pros":357,"cons":361},"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fapplied-cybersecurity\u002Fnice\u002Fnice-framework-resource-center","An employee dedicated to IT or security, on site and part of the team.","Salary, benefits, training and tools; one position can't cover nights, weekends or vacations","Larger small businesses whose specialized systems (OT, in-house software) need deep knowledge.",[358,359,360],"Knows the business, the people and the systems","On site and quick to react","Keeps knowledge in-house",[362,363,364],"Hard to hire: 65% of Quebec small and medium businesses say they lack qualified staff to manage cyber risk (KPMG, 2023)","One person can't provide 24\u002F7 monitoring","Knowledge walks out the door if they leave","\u002Fen\u002Fcomparisons\u002Fmsp-vs-mssp-vs-vciso-vs-in-house","---\ntitle: \"MSP vs MSSP vs vCISO vs In-House: Who Should Run Security?\"\ndescription: \"MSP, MSSP, vCISO or an in-house hire: roles, 24\u002F7 monitoring, independence and cost models compared to decide who runs cybersecurity at your small business.\"\ndate: 2026-10-24\nverified: \"October 2026\"\ntranslationKey: qui-gere-securite\nkeyword: \"MSP vs MSSP\"\noptions:\n  - name: \"Managed IT service provider (MSP)\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fcyber-security-considerations-consumers-managed-services-itsm50030\"\n    tagline: \"Your outsourced IT: workstations, servers, accounts, backups and day-to-day support.\"\n    pricing: \"On request; usually a monthly fee per user or per device\"\n    bestFor: \"Businesses with no in-house IT that first need well-run IT.\"\n    pros: [\"Covers daily operations: patching, accounts, backups\", \"Predictable monthly cost\", \"A team rather than one person\"]\n    cons: [\"Security isn't always in the contract\", \"Its privileged access to your systems makes it a target for attackers\", \"Hard for it to assess its own work objectively\"]\n  - name: \"Managed security service provider (MSSP \u002F MDR)\"\n    url: \"https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Fbuilding-a-security-operations-centre\"\n    tagline: \"A security team that watches your alerts, detects attacks and responds, often around the clock.\"\n    pricing: \"On request; usually a monthly subscription per device or per user\"\n    bestFor: \"Businesses that have tools (EDR, logs) but nobody watching alerts at night and on weekends.\"\n    pros: [\"Monitoring beyond office hours\", \"Specialized detection and response expertise\", \"Shares a cost a small business couldn't carry alone\"]\n    cons: [\"Doesn't always fix things itself: someone still has to act\", \"Scope varies widely from one contract to the next\", \"Doesn't set priorities or governance\"]\n  - name: \"Virtual CISO (vCISO)\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fbaseline-cyber-security-controls-small-and-medium-organizations\"\n    tagline: \"A part-time security lead who sets priorities, writes policies and keeps the plan on track.\"\n    pricing: \"On request; usually a monthly retainer or a block of hours\"\n    bestFor: \"Businesses facing client, insurer or framework requirements (Law 25, CPCSC, ISO 27001) without the budget for a full-time CISO.\"\n    pros: [\"Governance and a roadmap without a full-time salary\", \"Independent view of the IT provider's work\", \"Help with insurer and client questionnaires\"]\n    cons: [\"Doesn't handle daily operations\", \"Availability shared across several clients\", \"Only effective if leadership is engaged\"]\n  - name: \"In-house staff\"\n    url: \"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fapplied-cybersecurity\u002Fnice\u002Fnice-framework-resource-center\"\n    tagline: \"An employee dedicated to IT or security, on site and part of the team.\"\n    pricing: \"Salary, benefits, training and tools; one position can't cover nights, weekends or vacations\"\n    bestFor: \"Larger small businesses whose specialized systems (OT, in-house software) need deep knowledge.\"\n    pros: [\"Knows the business, the people and the systems\", \"On site and quick to react\", \"Keeps knowledge in-house\"]\n    cons: [\"Hard to hire: 65% of Quebec small and medium businesses say they lack qualified staff to manage cyber risk (KPMG, 2023)\", \"One person can't provide 24\u002F7 monitoring\", \"Knowledge walks out the door if they leave\"]\ncriteria:\n  - label: \"Main role\"\n    values: [\"Daily IT operations\", \"Monitoring, detection and response\", \"Governance, priorities and compliance\", \"Depends on the profile: operations, security or both\"]\n  - label: \"24\u002F7 alert monitoring\"\n    values: [\"Depends on the contract\", \"Often offered; confirm in the contract\", \"No\", \"No, unless there's a full team\"]\n  - label: \"Patching and hardening\"\n    values: [\"Yes, core of the mandate\", \"Depends on the contract\", \"No: sets the requirements\", \"Yes\"]\n  - label: \"Policies, response plan and roadmap\"\n    values: [\"Depends on the contract\", \"Partial: alert response procedures\", \"Yes, core of the mandate\", \"Depends on the person's expertise\"]\n  - label: \"Privileged access to your systems\"\n    values: [\"Yes, broad\", \"Yes, to security tools\", \"Limited\", \"Yes\"]\n  - label: \"Independence from IT operations\"\n    values: [\"Low: it would be assessing its own work\", \"Medium\", \"High if separate from the MSP\", \"Low\"]\n  - label: \"Accountability for incidents\"\n    values: [\"Stays with the business; roles set in the contract\", \"Stays with the business; roles set in the contract\", \"Stays with the business\", \"Stays with the business\"]\n  - label: \"What to require in writing\"\n    values: [\"MFA on its accounts, least privilege, logs kept at least 6 months\", \"Monitored scope, notification times, authorized actions\", \"Deliverables, check-in frequency, availability during incidents\", \"Job description and backup plan\"]\n  - label: \"Coverage during absences\"\n    values: [\"Yes (team)\", \"Yes (team)\", \"Partial\", \"No, unless backup is planned\"]\nverdict:\n  - profile: \"10-person law office in Sherbrooke with no in-house IT\"\n    pick: \"Managed IT service provider (MSP)\"\n    why: \"Well-run IT first, with security written into the contract: MFA, tested backups, patching. A periodic independent audit confirms it's actually done.\"\n  - profile: \"80-employee distributor in Laval with one in-house IT technician\"\n    pick: \"Managed security service provider (MSSP \u002F MDR)\"\n    why: \"The technician keeps operations and patching; the MSSP watches alerts at night and on weekends, when nobody is in the office.\"\n  - profile: \"40-employee aerospace subcontractor facing CPCSC certification\"\n    pick: \"Virtual CISO (vCISO)\"\n    why: \"It turns the requirements into a plan, prepares the assessment and oversees the IT provider, without the cost of a full-time executive role.\"\nfaq:\n  - q: \"Does my IT provider automatically handle cybersecurity?\"\n    a: \"Not necessarily. Some contracts cover support and maintenance without alert monitoring, backup testing or an incident response plan. Reread yours and ask in writing what's included. CISA recommends that contracts state whether the provider or the customer owns hardening, detection and incident response.\"\n  - q: \"What's the difference between an MSSP and an MDR service?\"\n    a: \"The terms overlap. An MSSP generally offers a range of managed security services, such as firewall management or log monitoring. An MDR (managed detection and response) service focuses on detecting attacks and responding, for instance by isolating a compromised workstation. Read the contract: the authorized actions and response times matter more than the label.\"\n  - q: \"Who's responsible for an incident if IT is outsourced?\"\n    a: \"Your business. The Canadian Centre for Cyber Security points out that the organization remains accountable for incident response, even when the provider carries out part of it. Under Quebec's Law 25, it's also the business that must notify the Commission d'accès à l'information and affected individuals when there's a risk of serious injury. Confirm how roles are split with legal counsel.\"\n  - q: \"Can a vCISO be our privacy officer under Law 25?\"\n    a: \"Law 25 assigns that role by default to the person with the highest authority in the business, who can delegate it in writing. A vCISO can certainly support that person on the security side. Handing the function itself to an outside person raises questions to check with legal counsel.\"\nsources:\n  - title: \"Canadian Centre for Cyber Security: Cyber security considerations for consumers of managed services (ITSM.50.030)\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fcyber-security-considerations-consumers-managed-services-itsm50030\"\n  - title: \"Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fbaseline-cyber-security-controls-small-and-medium-organizations\"\n  - title: \"CISA and partners (including the Canadian Centre for Cyber Security): Protecting against cyber threats to managed service providers and their customers (AA22-131A)\"\n    url: \"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa22-131a\"\n  - title: \"NCSC (UK): Building a Security Operations Centre\"\n    url: \"https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Fbuilding-a-security-operations-centre\"\n  - title: \"NIST: NICE Framework Resource Center\"\n    url: \"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fapplied-cybersecurity\u002Fnice\u002Fnice-framework-resource-center\"\n  - title: \"KPMG (via Newswire): cybercrime strikes more than six in 10 Quebec small and medium-sized businesses\"\n    url: \"https:\u002F\u002Fwww.newswire.ca\u002Fnews-releases\u002Fcybercrime-strikes-more-than-six-in-10-quebec-small-and-medium-sized-businesses-in-the-past-year-830782346.html\"\n  - title: \"LégisQuébec: Act respecting the protection of personal information in the private sector (P-39.1)\"\n    url: \"https:\u002F\u002Fwww.legisquebec.gouv.qc.ca\u002Fen\u002Fdocument\u002Fcs\u002FP-39.1\"\n---\n\nAsk a small business who looks after cybersecurity and you'll often get a vague answer: \"our IT guy,\" \"our provider,\" \"we have antivirus.\" That's not a criticism. According to a 2023 KPMG survey, 65% of Quebec small and medium businesses don't have qualified staff to manage cyber risk.\n\nThere are four models to choose from: a managed IT service provider (MSP), a managed security service provider (MSSP), a virtual CISO (vCISO) and in-house staff. They don't do the same job, and most businesses end up combining two of them.\n\n::callout{type=\"info\" title=\"Our method\"}\n- We compare operating models, not providers. The criteria draw on publications from the Canadian Centre for Cyber Security, CISA, the UK's NCSC and NIST, reviewed in October 2026.\n- Criteria: role, 24\u002F7 monitoring, patching, governance, privileged access, independence, accountability, contract requirements and continuity.\n- Cost models are described qualitatively: rates vary too much with size and scope to publish reliable figures.\n- This comparison is not sponsored.\n::\n\n## Four roles, not four versions of one service\n\nAn **MSP** runs your IT: it applies patches, manages accounts, watches backups and answers support calls. Security is part of its job to the extent the contract says so.\n\nAn **MSSP**, or an MDR service, watches. The UK's NCSC describes a security operations centre's role as limiting damage by detecting and responding to attacks that get past your preventive controls. This is the service that reacts at 3 a.m.\n\nA **vCISO** governs. The Canadian Centre for Cyber Security recommends that every organization name someone in a leadership role who is specifically responsible for IT security. A vCISO doesn't replace that person: it equips them, sets priorities, writes policies and makes sure the plan moves forward.\n\n**In-house staff** know the business better than anyone. The limit is simple arithmetic: one person can't cover nights, weekends or their own vacations.\n\n## What outsourcing doesn't transfer\n\nOutsourcing the work doesn't outsource the responsibility. The Canadian Centre for Cyber Security is explicit: the organization remains accountable for incident response, even when the provider carries out part of it. It also recommends that the service agreement set out response times, communication channels and the escalation process.\n\nThe provider is itself a risk. MSPs are prime targets because their privileged access opens the door to many clients at once. An advisory from CISA and its partners, including the Canadian Centre, recommends requiring by contract multi-factor authentication on every provider account, retention of key logs for at least six months, and removal of the provider's access when the contract ends. Our guide on how to [evaluate your IT provider's security](\u002Fen\u002Fblog\u002Fevaluate-it-provider-security) lists the questions to ask.\n\nFinally, under Quebec's Law 25, the [privacy officer](\u002Fen\u002Fblog\u002Fprivacy-officer-quebec-security-role) is by default the person with the highest authority in the business. No provider takes on that role for you without a written delegation; confirm those choices with legal counsel.\n\n## Independence: the common blind spot\n\nWhen the same provider configures your systems, monitors them and tells you everything is fine, nobody is checking its work. It's not a question of honesty: it's hard to objectively assess what you set up yourself. A vCISO separate from the MSP, or a periodic independent audit, fills that gap.\n\n## The most common combinations\n\n- **MSP alone, with a periodic audit**: the starting point for small businesses.\n- **MSP plus MSSP**: operations by day, monitoring around the clock.\n- **MSP plus vCISO**: when clients, an insurer or a program such as CPCSC set specific requirements.\n- **In-house staff plus MSSP**: the employee keeps hands-on control, and the MSSP covers the hours they're away.\n\nWhatever the mix, your [incident response plan](\u002Fen\u002Fblog\u002Fincident-response-plan-template-small-business) should spell out who calls whom, and who is allowed to isolate a workstation or cut off access.\n\n## How to choose\n\nAnswer four questions honestly:\n\n1. **Who applies patches today, and how quickly?** If nobody can answer, start with an MSP or an in-house hire.\n2. **Who would see an alert at 3 a.m. on a Sunday?** If the answer is \"nobody,\" you need an MSSP or MDR service.\n3. **Who fills out insurer and client questionnaires?** If it's leadership, alone and unsupported, a vCISO lightens the load.\n4. **Who checks the provider's work?** If nobody does, plan for an independent review.\n\nOur [ongoing security partner](\u002Fen\u002Fservices\u002Fongoing-security-partner) service acts as a vCISO for small businesses, working alongside their existing IT provider.\n\n::cta{variant=\"devis\"}\n::\n",{"title":47,"description":291},[369,371,373,376,378,380,383],{"title":370,"url":312},"Canadian Centre for Cyber Security: Cyber security considerations for consumers of managed services (ITSM.50.030)",{"title":372,"url":340},"Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations",{"title":374,"url":375},"CISA and partners (including the Canadian Centre for Cyber Security): Protecting against cyber threats to managed service providers and their customers (AA22-131A)","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa22-131a",{"title":377,"url":326},"NCSC (UK): Building a Security Operations Centre",{"title":379,"url":353},"NIST: NICE Framework Resource Center",{"title":381,"url":382},"KPMG (via Newswire): cybercrime strikes more than six in 10 Quebec small and medium-sized businesses","https:\u002F\u002Fwww.newswire.ca\u002Fnews-releases\u002Fcybercrime-strikes-more-than-six-in-10-quebec-small-and-medium-sized-businesses-in-the-past-year-830782346.html",{"title":384,"url":385},"LégisQuébec: Act respecting the protection of personal information in the private sector (P-39.1)","https:\u002F\u002Fwww.legisquebec.gouv.qc.ca\u002Fen\u002Fdocument\u002Fcs\u002FP-39.1","en\u002Fcomparisons\u002Fmsp-vs-mssp-vs-vciso-vs-in-house","qui-gere-securite",null,[390,393,396],{"profile":391,"pick":311,"why":392},"10-person law office in Sherbrooke with no in-house IT","Well-run IT first, with security written into the contract: MFA, tested backups, patching. A periodic independent audit confirms it's actually done.",{"profile":394,"pick":325,"why":395},"80-employee distributor in Laval with one in-house IT technician","The technician keeps operations and patching; the MSSP watches alerts at night and on weekends, when nobody is in the office.",{"profile":397,"pick":339,"why":398},"40-employee aerospace subcontractor facing CPCSC certification","It turns the requirements into a plan, prepares the assessment and oversees the IT provider, without the cost of a full-time executive role.","October 2026","RVzQAu1eFAwejyYUDRg1cx8zxptO3pngJ6DhIiigeNM",{"path":402},"\u002Fcomparatifs\u002Fmsp-mssp-vciso-ressource-interne",[404,408,412],{"path":405,"title":406,"description":407},"\u002Fen\u002Fcomparisons\u002Fantivirus-vs-edr-vs-mdr","Antivirus vs EDR vs MDR: Which Endpoint Protection Do You Need?","Antivirus, EDR or MDR? Detection, response, 24\u002F7 monitoring, in-house skills and cost model compared for small businesses with 10, 50 or 150 employees.",{"path":409,"title":410,"description":411},"\u002Fen\u002Fcomparisons\u002Fbackup-nas-vs-cloud-vs-hybrid","Backups: Local NAS vs Cloud vs Immutable Storage vs Hybrid","On-site NAS, cloud backup, immutable storage or a hybrid 3-2-1-1-0 setup: ransomware resilience, restore speed, cost model and Canadian data residency compared.",{"path":413,"title":414,"description":415},"\u002Fen\u002Fcomparisons\u002Fbusiness-password-managers","1Password vs Bitwarden vs Keeper vs Dashlane for Business","1Password, Bitwarden, Keeper or Dashlane? Canadian data hosting, SSO, SCIM, pricing and compliance compared side by side for Canadian small businesses.",1792972906281]