# MSP vs MSSP vs vCISO vs In-House: Who Should Run Security?

Source : https://cybercaribou.com/en/comparisons/msp-vs-mssp-vs-vciso-vs-in-house · Cyber Caribou

> MSP, MSSP, vCISO or an in-house hire: roles, 24/7 monitoring, independence and cost models compared to decide who runs cybersecurity at your small business.

Ask a small business who looks after cybersecurity and you'll often get a vague answer: "our IT guy," "our provider," "we have antivirus." That's not a criticism. According to a 2023 KPMG survey, 65% of Quebec small and medium businesses don't have qualified staff to manage cyber risk.

There are four models to choose from: a managed IT service provider (MSP), a managed security service provider (MSSP), a virtual CISO (vCISO) and in-house staff. They don't do the same job, and most businesses end up combining two of them.

- We compare operating models, not providers. The criteria draw on publications from the Canadian Centre for Cyber Security, CISA, the UK's NCSC and NIST, reviewed in October 2026.
- Criteria: role, 24/7 monitoring, patching, governance, privileged access, independence, accountability, contract requirements and continuity.
- Cost models are described qualitatively: rates vary too much with size and scope to publish reliable figures.
- This comparison is not sponsored.

## Four roles, not four versions of one service

An **MSP** runs your IT: it applies patches, manages accounts, watches backups and answers support calls. Security is part of its job to the extent the contract says so.

An **MSSP**, or an MDR service, watches. The UK's NCSC describes a security operations centre's role as limiting damage by detecting and responding to attacks that get past your preventive controls. This is the service that reacts at 3 a.m.

A **vCISO** governs. The Canadian Centre for Cyber Security recommends that every organization name someone in a leadership role who is specifically responsible for IT security. A vCISO doesn't replace that person: it equips them, sets priorities, writes policies and makes sure the plan moves forward.

**In-house staff** know the business better than anyone. The limit is simple arithmetic: one person can't cover nights, weekends or their own vacations.

## What outsourcing doesn't transfer

Outsourcing the work doesn't outsource the responsibility. The Canadian Centre for Cyber Security is explicit: the organization remains accountable for incident response, even when the provider carries out part of it. It also recommends that the service agreement set out response times, communication channels and the escalation process.

The provider is itself a risk. MSPs are prime targets because their privileged access opens the door to many clients at once. An advisory from CISA and its partners, including the Canadian Centre, recommends requiring by contract multi-factor authentication on every provider account, retention of key logs for at least six months, and removal of the provider's access when the contract ends. Our guide on how to [evaluate your IT provider's security](https://cybercaribou.com/en/blog/evaluate-it-provider-security) lists the questions to ask.

Finally, under Quebec's Law 25, the [privacy officer](https://cybercaribou.com/en/blog/privacy-officer-quebec-security-role) is by default the person with the highest authority in the business. No provider takes on that role for you without a written delegation; confirm those choices with legal counsel.

## Independence: the common blind spot

When the same provider configures your systems, monitors them and tells you everything is fine, nobody is checking its work. It's not a question of honesty: it's hard to objectively assess what you set up yourself. A vCISO separate from the MSP, or a periodic independent audit, fills that gap.

## The most common combinations

- **MSP alone, with a periodic audit**: the starting point for small businesses.
- **MSP plus MSSP**: operations by day, monitoring around the clock.
- **MSP plus vCISO**: when clients, an insurer or a program such as CPCSC set specific requirements.
- **In-house staff plus MSSP**: the employee keeps hands-on control, and the MSSP covers the hours they're away.

Whatever the mix, your [incident response plan](https://cybercaribou.com/en/blog/incident-response-plan-template-small-business) should spell out who calls whom, and who is allowed to isolate a workstation or cut off access.

## How to choose

Answer four questions honestly:

1. **Who applies patches today, and how quickly?** If nobody can answer, start with an MSP or an in-house hire.
2. **Who would see an alert at 3 a.m. on a Sunday?** If the answer is "nobody," you need an MSSP or MDR service.
3. **Who fills out insurer and client questionnaires?** If it's leadership, alone and unsupported, a vCISO lightens the load.
4. **Who checks the provider's work?** If nobody does, plan for an independent review.

Our [ongoing security partner](https://cybercaribou.com/en/services/ongoing-security-partner) service acts as a vCISO for small businesses, working alongside their existing IT provider.

## FAQ

**Does my IT provider automatically handle cybersecurity?**
Not necessarily. Some contracts cover support and maintenance without alert monitoring, backup testing or an incident response plan. Reread yours and ask in writing what's included. CISA recommends that contracts state whether the provider or the customer owns hardening, detection and incident response.

**What's the difference between an MSSP and an MDR service?**
The terms overlap. An MSSP generally offers a range of managed security services, such as firewall management or log monitoring. An MDR (managed detection and response) service focuses on detecting attacks and responding, for instance by isolating a compromised workstation. Read the contract: the authorized actions and response times matter more than the label.

**Who's responsible for an incident if IT is outsourced?**
Your business. The Canadian Centre for Cyber Security points out that the organization remains accountable for incident response, even when the provider carries out part of it. Under Quebec's Law 25, it's also the business that must notify the Commission d'accès à l'information and affected individuals when there's a risk of serious injury. Confirm how roles are split with legal counsel.

**Can a vCISO be our privacy officer under Law 25?**
Law 25 assigns that role by default to the person with the highest authority in the business, who can delegate it in writing. A vCISO can certainly support that person on the security side. Handing the function itself to an outside person raises questions to check with legal counsel.

## Sources

- [Canadian Centre for Cyber Security: Cyber security considerations for consumers of managed services (ITSM.50.030)](https://www.cyber.gc.ca/en/guidance/cyber-security-considerations-consumers-managed-services-itsm50030)
- [Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations](https://www.cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and-medium-organizations)
- [CISA and partners (including the Canadian Centre for Cyber Security): Protecting against cyber threats to managed service providers and their customers (AA22-131A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131a)
- [NCSC (UK): Building a Security Operations Centre](https://www.ncsc.gov.uk/collection/building-a-security-operations-centre)
- [NIST: NICE Framework Resource Center](https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center)
- [KPMG (via Newswire): cybercrime strikes more than six in 10 Quebec small and medium-sized businesses](https://www.newswire.ca/news-releases/cybercrime-strikes-more-than-six-in-10-quebec-small-and-medium-sized-businesses-in-the-past-year-830782346.html)
- [LégisQuébec: Act respecting the protection of personal information in the private sector (P-39.1)](https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1)