Short answer
FirstNet offers its Sophos-based managed security in three tiers: Standard, Enhanced and Premium. All three include Sophos MDR's 24/7 monitoring, and FirstNet's Incident Response team acts on Sophos alerts.
In detail
What each tier adds:
- Standard: Sophos MDR 24/7 monitoring, threat hunting and analyst-led detection. FirstNet responds to Sophos alerts and handles customer success and escalation as your runbook sets out.
- Enhanced: all of Standard, plus a named customer-success contact, more incident response support, longer telemetry retention and more reports.
- Premium: all of Enhanced, plus extended incident response, with on-site remediation support where it applies. It also adds executive reports and dedicated runbook engineering.
FirstNet's approved service catalogue and your contract set the service levels for each tier. They are not one-off promises made in sales talks.
Your choice of tier usually comes down to three things. How much in-house security capacity do you have? What are your retention and reporting duties? Would you want on-site help during an incident?
FirstNet confirms the tier during discovery, along with which telemetry sources to connect.
Source: FirstNet Managed Cybersecurity Services service page →
Didn’t answer your question?