Register of Vendor Pricing · Compiled by Digital Signet · Revised 20 June 2026
Annex VII · Decoder

SOC quote decoder.

A question ladder for any vendor quote. Each yes / no answer shifts the negotiation surface. Work top to bottom; the further down you decode without finding a red flag, the better the quote.

Direct answer

Eight decoder questions cover the negotiable surface of any MDR quote in 2026. The red flags cluster around 'starting at' language, ingest overage rates, undefined 24x7 scope, undefined IR retainer overage, and uncapped escalators.

The question ladder

  1. Q1

    Is the per-endpoint band stated as 'starting at' or as a fixed rate?

    If yesStarting-at language is a red flag. Ask for the contracted rate at the customer's actual endpoint count and the price per endpoint above that count.

    If noFixed-rate quote. Lock the rate to a contract clause and add an escalation cap.

  2. Q2

    Is ingest charged separately, or 'included up to X GB / day'?

    If yesSeparately means a per-GB overage rate. Get the overage rate in writing; cap it at $ 0.50 / GB.

    If no'Included up to X GB / day' means an unstated overage rate above X. Get the overage rate and cap it; require advance notice on approach.

  3. Q3

    Is 24x7 stated as included, or as an uplift over business hours?

    If yesIncluded. Confirm in writing that 24x7 covers triage and response, not just monitoring.

    If noUplift. Capture the multiplier (typically 1.3 to 1.5x business-hours base) and lock it.

  4. Q4

    Are IR retainer hours included, separately purchased, or available on demand at an hourly rate?

    If yesIncluded. Confirm the hours per year and the overage rate after exhaustion.

    If noSeparately purchased. The hourly rate is the negotiation surface; typical range $ 350 to $ 600 / hour.

  5. Q5

    Is the contract assignable on merger or acquisition?

    If yesYes. Standard.

    If noNo or silent. Add an assignability clause; M&A activity is the most common contract-termination trigger.

  6. Q6

    Is the off-boarding data export priced as a one-time fee?

    If yesYes. Cap the fee at $ 10,000.

    If noSilent. The vendor will quote it at termination; specify the fee cap and the retention window in the contract.

  7. Q7

    Is the annual price escalator capped?

    If yesYes. Confirm the cap (typically CPI or 4 percent, whichever is lower) and the multi-year fix.

    If noNo. Negotiate a cap before signing.

  8. Q8

    Is the SLA tied to service credits with a defined trigger?

    If yesYes. Confirm the credit per SLA miss and the cap on credits per month.

    If noSilent. The SLA is decorative. Tie credits to MTTD / MTTA / MTTR targets and cap at 25 to 50 percent of monthly fee.

Use alongside /annex/rfp-template. The decoder is for the post-quote negotiation phase; the RFP template is for the pre-quote scoping phase.

Annex cross-references

AnnexRFP templateThe pre-quote scoping document.AnnexHidden costsThe full schedule of hidden lines the decoder is hunting.AnnexSLA matrixThe SLA targets to lock the service credits to.