Clarify MDR Authority Outside Normal Working Hours
Identify who can decide, act, and communicate during overnight escalations.
An on call number does not tell you whether a customer can respond after hours. An MDR consultant should ask who can validate an alert, approve containment, and contact the business. This maps decision rights without requiring sensitive incident details.
Some teams have an analyst available but no application owner able to approve a change. Others have a detailed tree that is rarely tested. Both cases create useful questions about operational readiness.
At a fictional online retailer, the overnight analyst can review cloud alerts but cannot disable a risky account without a manager. Map that fact and ask how the customer wants a provider to escalate it. The customer defines authority boundaries.
Do not imply that a service can act beyond customer policy. Service discussions should make constraints visible early, especially when an overnight response involves several business owners.
In roleplay, let the buyer say, “Someone is always available.” The consultant should ask what that person can decide and who is contacted for approval. Then summarize the sequence.
Use DealSpeak to coach simple language and named roles. Score whether the consultant finds the trigger, authority gap, and next customer action without promising a response outcome. A usable map is the goal of this discovery call.
Practice these next
Define update timing and recipients before operations rely on a service handoff.
Connect escalation choices to business impact the customer defines.
Create a clear route for questions and incidents during a financial services launch.
Guide an alert report into the required service and complaint path without making a safety conclusion.
A delivery director can make a blocked dependency easier to resolve by explaining its evidence, delivery effect, and the client owner who can decide.
Map alert ownership and escalation choices with the operations team.