The organization has outsourced its security operations center to a managed security service provider. Which responsibility should remain with the organization?

Outsourcing transfers the performance of activities, not accountability for the risk they manage. When security operations move to a managed provider, the organization must retain governance: defining requirements and service levels, monitoring performance against them, managing the contract, ensuring escalation and incident decisions involve the right internal parties, and answering to regulators and the board for security outcomes. Retaining this oversight capability, including people who understand the service well enough to challenge it, is essential. Day-to-day monitoring and triage is precisely the operational work that was outsourced; keeping it in-house would defeat the purpose of the arrangement. Tuning detection rules on the provider's platform is normally the provider's responsibility within agreed requirements, although the organization should review its effectiveness through reporting. Staffing and shift scheduling of the provider's analysts are internal management matters for the provider, governed indirectly through service-level commitments rather than direct control. Exam caveat: contracts can allocate specific tasks either way, but accountability cannot be contracted away. Operational check: confirm a named internal owner reviews the provider's service-level reports, participates in escalations and reports provider performance to management.