Starting Point, so we do not waste your time

• Tell me about your current detection posture, including where you have visible gaps and where you are confident
• How often does your team run tabletop exercises or simulated phishing for high-value users Options: Weekly, Monthly, Quarterly, Annually, Ad hoc
• Which telemetry sources does your program ingest today for trading workstations, payment systems, and cloud workloads Options: Endpoint telemetry (EDR), Network flow/export, SWIFT or payments logs, Cloud workload logs, Identity and directory logs, None of the above
• When was the last time an alert escalated to the CTO or CISO level and required an executive briefing Options: Within 1 week, Within 1 month, Within 3 months, More than 3 months, Never
• Describe who signs the quarterly security briefing the board receives and what metric they insist on seeing Options: CISO signs, requires incident trends, CISO and COO, require SLA metrics, Risk officer only, requires regulatory posture, Other
• Who is the day-to-day operational owner of your SIEM integration and who would be the primary contact for connector access Options: SOC manager, Platform engineering, Cloud operations, Third-party integrator, No owner assigned
• Would lack of access to a core telemetry feed block a hands-on evaluation for you Options: Yes, evaluation cannot proceed, No, we can provide substitutes, Maybe, depends on which feed

Where detection fails first and why that matters

• When a phishing email reaches a senior trader, what breaks downstream first and why
• Walk me through the last time a threat bypassed controls, from first signal to containment and lessons learned
• Estimate the direct business impacts you track for those incidents, ranked by severity Options: Service outage or payment delay, Regulatory notification and fines, Customer or counterparty impact, Trader productivity loss, Reputational damage
• Which controls or integrations failed to surface the activity in that incident Options: Email gateway, Endpoint telemetry, Network monitoring, SIEM correlation, Identity analytics, None identified
• How often do alerts from those controls require cross-team escalation to resolve Options: Daily, Weekly, Monthly, Rarely, Never

The incident that woke the board

• If a senior trader's inbox was used to seed lateral movement tomorrow, who on your team can pause payment processing within the regulatory window Options: CISO, Head of operations, CTO, Payments manager, No single authority
• Tell me about the most recent near miss that escalated to compliance or legal, what the timeline looked like and which evidence mattered most
• What specific incident metrics and narratives do you include in the quarterly board briefing today Options: Executive risk summary, Incident timelines and root cause, Regulatory status and open items, Risk appetite vs actuals, All of the above
• Estimate how many hours your incident response team would need to reach containment in a payment-related compromise Options: Less than 4 hours, 4 to 12 hours, 12 to 24 hours, 24 to 72 hours, More than 72 hours
• Who must approve the NYDFS attestation or equivalent filing before you change monitoring or report externally Options: CISO, Legal, Head of compliance, Board representative, Unsure

Constraints and realities that stop pilots cold

• Name any single integration, data feed, or environment that, if unavailable, would stop a pilot from running
• List the telemetry endpoints you can realistically expose within four weeks for a hands-on evaluation Options: Endpoint logs, Network flow export, Payment rails logs (SWIFT/ACH), Cloud provider logs, Directory and identity logs, None available
• Identify which internal team owns API credentials and is authorized to provide access during an evaluation Options: Platform engineering, Network team, Cloud ops, Identity team, Third-party vendor, No clear owner
• Do you have a dedicated engineer available during business hours to support agent rollout and connector configuration Options: Yes, internal resource assigned, Yes, can assign a contractor, No, can assign if needed, No, not available
• Approximately how many legacy endpoints will require special tuning or cannot accept the agent model Options: 0 to 100, 101 to 500, 501 to 2,000, More than 2,000, Unknown
• Are there contract, legal, or regulatory approvals that typically add more than 30 days to a deployment Options: Yes, legal reviews, Yes, procurement approvals, Yes, regulator signoff, No, timeline under 30 days, Unsure

The other options you're weighing

• List the vendors, incumbents, and internal options you are actively comparing for detection and response Options: Incumbent managed provider, Internal build, Large security vendor, Boutique MDR provider, Assessment-only engagement, Other
• What would need to be true about your current incumbent for you to stay with them rather than change
• Has anyone inside proposed building the detection capability internally instead of contracting an external provider Options: Yes, planned and resourced, Yes, suggested but not resourced, No one has proposed that, Unsure
• Name the internal performance or cost metrics that would have to improve to justify staying with the incumbent Options: Mean time to detect, Mean time to respond, False positive rate, Coverage of critical ATT&CK techniques, Cost per alert, Other
• If an internal build is on the table, what timeline has been proposed to reach parity with your acceptance criteria Options: Less than 3 months, 3 to 6 months, 6 to 12 months, More than 12 months, No timeline provided

Acceptance criteria that will close the deal

• Identify the single metric that would make the CISO sign pilot success without additional proof Options: Detection coverage percent, False positive rate threshold, Mean time to detect, Mean time to respond, Regulatory attestation delivered, Other
• Specify your target false positive rate for alerts that will be routed to your SOC Options: Less than 1%, 1 to 3%, 3 to 5%, Greater than 5%, TBD
• State the named acceptance owners and the specific data each owner will require to validate pilot outcomes
• Assuming the evaluation meets the targets, which internal approvals remain before procurement can execute the contract Options: Legal signoff, Procurement approval, Budget owner signoff, Executive sponsor signoff, All of the above
• Within how many weeks do you need measurable improvement to satisfy your board reporting cycle Options: 2 weeks, 4 weeks, 8 weeks, 12 weeks, More than 12 weeks

Deployment realities and immediate risk triggers

• Where will visibility gaps during rollout cause the most regulatory or operational risk Options: Payments stack, Trading desktops, Cloud workloads, Identity and access layer, Third-party connections, Other
• Walk me through your planned agent rollout sequencing for high-value workstations, servers, and payment gateways
• Describe legacy operating systems or payment systems that are likely to block agent installation or degrade performance
• Provide the role or team that will own day-to-day tuning and first-line SOC triage during the tuning window Options: Internal SOC, Shared SOC and vendor, Third-party SOC, No team assigned yet
• Explain the metrics you will use to measure performance impact on legacy endpoints during rollout Options: CPU and memory delta, Application error rates, User-reported faults, Agent rollback rate, All of the above
• In practice, what incident would cause you to halt the deployment immediately

Next decisions, timelines, and kill criteria

• Assuming the pilot proves the detection gaps are closed, what remaining obstacle would still stop you from signing within seven days
• Outline the procurement timeline and key milestones you need to clear to finalize a contract Options: Procurement review only, Procurement plus legal, Procurement, legal, and board, Multiple committees required
• State the role that will be the single point of contact for demo data access and operational questions Options: SOC manager, Platform engineer, Security architect, Procurement lead, No single point yet
• Share any legal or commercial redlines that would be deal killers for your team Options: Unlimited data retention mandates, Unacceptable data access terms, Indemnity clauses, SLAs below required thresholds, No major redlines
• Give your target decision window after evaluation completes, in days Options: 0 to 7 days, 8 to 14 days, 15 to 30 days, More than 30 days, Undecided

• Stakeholder Alignment Kickoff
• Acceptance Criteria and Scoring Workshop
• Evaluation Data Set Design and Delivery
• Test Harness, SIEM Integration, and Evidence Collection Agreement
• Final Acceptance Sign-off and Next Steps

• Deploy test harness components in the agreed staging environment and run baseline connectivity checks.
• Produce the dataset extracts according to the agreed inventory and run the verification checks.
• Implement anonymization and redaction rules for each data field identified.
• Publish the scenario catalog with expected detection markers and verification steps.
• Define test harness architecture and environment requirements
• A test harness plan with environment specs and a deployment checklist for staging.
• Signed SIEM test case list and expected ingestion artifacts for verification.
• Standardized evidence capture templates and timestamp alignment rules for scoring audits.
• Confirm participants and decision roles
• Publish evidence capture templates and timestamp alignment rules to the shared workspace.
• Configure SIEM test connectors and execute a small ingestion test to validate artifacts.
• Present the compiled acceptance package
• Formal sign-off on the acceptance package or a documented remediation list with deadlines.
• Named owners and dates for any remediation, retest windows, and final decision milestones.
• A handover checklist ready for procurement and deployment once acceptance is achieved.
• Publish the final acceptance package and sign-off record to the shared workspace.
• Log remediation items with deadlines and include them in the project tracker.
• Schedule the retest window and notify stakeholders of the date and scope.
• A documented list of participants with named decision authorities for acceptance and scoring.
• An agreed evaluation timeline with milestone dates for dataset delivery, test windows, and sign-off.
• A draft acceptance criteria matrix and initial dataset inventory assigned for follow-up.
• Publish the draft acceptance criteria matrix to the shared workspace within 24 hours.
• Produce a dataset inventory listing telemetry sources, custody, and known access blockers.
• Circulate the agreed evaluation timeline and milestone calendar.
• Recap high level objectives tied to each metric
• A finalized acceptance criteria matrix with metric definitions and numeric thresholds for each category.
• A documented weighting and pass fail rule set that will be used to compute final scores.
• A list of any metrics that require additional data or instrumentation before scoring can begin.
• Publish the finalized acceptance criteria matrix and scoring rules to the shared workspace.
• Produce a sample scoring worksheet showing how weights and thresholds compute the pass fail outcome.
• List data or instrumentation gaps required to measure any outstanding metrics.
• Validate required telemetry types and retention windows
• A signed dataset inventory with exact extracts, schemas, and retention windows ready for production of test data.
• A scenario catalog mapping each test case to expected detection signals and verification criteria.
• A documented anonymization and access control plan for dataset delivery.
• Validate objectives and constraints
• Agree SIEM connectivity and test cases
• Confirm each criterion as accepted or list gaps
• Define scenario catalog and acceptance signal markers
• Define detection coverage metrics and thresholds
• Finalize evidence capture templates and timestamp rules
• Agree anonymization, redaction, and access controls
• Schedule remediation and retest windows if required
• Define false positive, precision, and alert fidelity metrics
• Agree evaluation timeline and milestones
• Decide scoring automation and report format
• Draft acceptance criteria matrix overview
• Record sign-off and handover actions
• Set delivery method, verification checks, and handoff verification
• Define response effectiveness and MTTR metrics
• Confirm initial dataset inventory and access needs
• Agree weighting, pass fail rules, and remediation gates

Environment and site access

• Which environments should be included in the initial rollout? (select all that apply — determines sensor scope and sequencing) Options: Production, Pre-production / staging, Development / test, Cloud workloads, On‑prem datacenters, Remote / branch sites, Other — specify below
• For the selected environments, is network connectivity from the seller's deployment network to the integration endpoints (SIEM ingest, agent management, cloud APIs) already permitted? (so we know if firewall/ACL changes are required) Options: Yes — all required endpoints reachable, Partially — some endpoints blocked or require ACL changes, No — network access not yet approved, Unknown — need a connectivity test
• If you answered 'Partially', 'No', or 'Unknown', list the environment(s) and the expected date when network or firewall changes will be completed (so we can schedule the rollout).

Data and configuration

• Which telemetry sources will be onboarded in the initial phase? (select all that apply — used to plan connectors and validation datasets) Options: Endpoint telemetry (EDR agents), Network flow / sensors, SIEM log ingest, Cloud workload logs, Transaction logs (ACH / SWIFT), Identity / authentication logs, Other — specify
• Has the buyer designated owners for the source-of-truth mapping for each telemetry source (the contact who provides sample data and signs off on visibility)? Options: Yes — owners documented and contactable, Partial — some sources missing owners, No — owner assignment pending, Seller to lead onboarding with buyer direction
• If 'Partial' or 'No', provide the owner (team or person) for each undecided source and the target date for owner assignment (so we can lock acceptance test contacts).

People and ownership

• Please name the buyer-side owners to appear on the deployment plan: security lead (CISO delegate), network/SysOps owner, SIEM owner, and change approver. Provide 'role: name, email, phone' for each (these contacts unblock approvals and incidents).
• Are system-level access approvals in place for the seller to install agents/connectors and use required service accounts in each environment? (this determines whether we can schedule hands-on work) Options: Yes — approvals completed for all environments, Partially — some environments pending approvals, No — approvals required before scheduling, Approvals require buyer legal/compliance sign-off
• If approvals are partial or pending, list which environments need approvals and the expected approval completion dates.

Timing and constraints

• Provide approved maintenance windows or blackout restrictions per environment (days/times or 'no maintenance window'); we use this to plan install and cutover windows.
• Are there compliance events, regulatory reporting periods, audits, or scheduled trading/settlement windows that create deployment freezes? If yes, provide dates or ranges. Options: No, Yes — freeze windows provided below, Unknown — buyer compliance to confirm
• What target cadence should we use for the phased rollout? (select one — defines sequencing, training and tuning windows) Options: Pilot (1–2 sites) then phased 2–4 weeks between phases, Weekly phased rollout, Monthly phased rollout, Big-bang across selected environments on a single date, Undecided — seller to propose schedule

Agent & Network Sensor Configuration

• Enter the exact agent policy name to apply to production endpoints (case-sensitive). Default: "Default-Agent-Policy".
• Select the agent policy variant to install on endpoints (choose the single variant the deployment should apply). Default: "Standard (lightweight)". Options: Standard (lightweight), Full (all telemetry), Compliance-only (logs only)
• Number of network sensors to deploy in production (numeric). Default: 2.

Connectors, Cloud Sources & Secrets Exchange

• Select the SIEM integration method you will use for alert/log export (choose one). Options: Syslog (CEF/LEEF), Native API connector, SIEM forwarder agent, None / will onboard later
• Enter your SIEM ingestion endpoint URL used for this integration (format: https://your-siem.example.com/ingest). Do not paste credentials here.
• Enter the primary cloud connector identifier for production (cloud account ID or org name — e.g., AWS account ID, GCP project, or tenant name).
• Preferred secure channel for exchanging non-secret credential material and arranging secret handoff (select one). NOTE: do NOT paste secrets here; this only identifies the channel. Options: Your secrets manager (preferred), Secure procurement portal, SFTP with key exchange, Secure chat/workflow with MFA, Other — will confirm separately

Alerting, Ticketing & Escalation

• Alert score threshold (0-100) above which alerts are automatically escalated to on-call SOC. Default: 90.
• Select the primary ticketing/incident channel category to create tickets (choose one). Options: ITSM - ticketing (your ITSM), Chat-ops / webhook to on-call roster, Email-to-ticket bridge, None / manual ticketing
• Enter the non-secret ticketing integration identifier to use (service account name or integration client ID — do NOT paste API secrets).

• Receive written go‑live approval from designated buyer approver(s)
• Confirm acceptance‑criteria test report submitted and approved
• Validate representative telemetry ingestion into the monitoring console/SIEM
• Confirm alert tuning rules applied and suppression results documented
• Execute and document a simulated incident end‑to‑end
• Obtain SOC analyst training completion and playbook sign‑off
• Verify performance and stability baselines on representative systems
• Confirm SIEM/ticketing integration and alert routing live
• Receive written Permission to Operate (PTO) or equivalent from buyer and document rollback conditions
• Archive validation evidence bundle and close validation checklist