Kenyan firms should start by mapping the systems and data whose loss would cause the greatest disruption, such as payment platforms, customer records, payroll or cloud‑based applications.

The next step is to consider the likely impact of specific threats – for example, a stolen email account could enable fraud, while ransomware could halt access to critical files.

When reviewing proposals, businesses must request a written list of protected assets, any exclusions and limits on users, devices or locations, because monitoring does not automatically cover every endpoint or cloud account.

Clarify the distinction between detection and response: some providers only alert the client, leaving investigation, isolation and restoration to the business, while others include hands‑on response under agreed conditions.

Ask how alerts are generated, escalated and communicated, and whether monitoring runs continuously or only during set hours, as delayed review can give attackers more time to compromise systems.

Ensure backup and recovery are part of the service or clearly defined as a separate responsibility; verify backup frequency, retention, protection from unauthorized deletion and the ability to restore within an acceptable timeframe.

Review access‑control provisions, including support for multi‑factor authentication, role‑based permissions and the removal of access for departing staff or contractors, as well as controls over the provider’s own personnel.

Demand regular reporting that distinguishes alerts from confirmed incidents, highlights recurring vulnerabilities and tracks response performance, with clear escalation paths for unresolved risks.

When comparing providers, focus on outcomes – such as monitoring hours, device coverage, response assistance, backup services and reporting – rather than price alone, and separate recurring fees from implementation or incident‑related charges.

Finally, scrutinise service‑level agreements for response times tied to incident severity, data‑handling clauses, confidentiality, termination procedures and the return or deletion of customer data at contract end.