This decision tree belongs to the false-positive investigation closure guide. It sorts the roles a security partner meets into three groups: those who know, those who hold, and those who can decide.
The first fork: provider or in-house SOC?
Everything else depends on whose records these are. Ask this before anything else.
- Managed security provider (MSSP or MDR). The provider monitors other companies' environments. Its own work product (case notes, rule versions, tuning decisions, playbooks) sits next to client telemetry it processes on the client's behalf. Under the GDPR, a processor must act only on the controller's documented instructions, and a processor that decides purposes and means for itself is treated as a controller for that processing. Client agreements usually say the same thing in commercial terms. The authority question is therefore partly the provider's and partly its clients'.
- In-house SOC. The security team works for one company. The records belong to that company, and authority follows its internal governance.
Branch by branch: managed provider
- Who runs closure day to day? The SOC director or SOC manager. Sponsor, not signer.
- Who owns the tuning history? The detection engineering lead owns rule versions, change rationale and review comments. They confirm completeness; they do not approve licensing.
- Who holds the keys? The SIEM administrator can export alerts and incidents. In Microsoft Sentinel, for instance, alerts from every source sit together in one table, each with an internal SystemAlertId. Being able to query that table is technical access, not authority.
- What do client contracts say? General counsel or the contracts lead reads the master services agreements and data processing terms. This branch often decides the outcome: provider-authored notes and rules may be the company's own, while anything derived from client telemetry may need client consent or exclusion.
- Who decides? The CEO, who in a founder-run provider is usually the founder, within authority delegated by the board. Under Delaware law, for example, a corporation's business and affairs are managed by or under the direction of its board of directors.
- SourceX's rights review. Confirms scope, form and conditions before any dataset is proposed.
Branch by branch: in-house SOC
- Sponsor. The SOC manager or head of security operations.
- Owner. The CISO owns the security function's records inside the company.
- Consulted. Legal on privacy and confidentiality, the privacy officer on employee monitoring data, and IT on system access.
- Decides. The CEO, with the CISO sponsoring and legal and the CFO advising, because security records are sensitive by nature.
- Rights review. As above.
Roles and what each can approve
| Role | What they know or hold | Can authorize a licensing discussion? |
|---|---|---|
| SOC director or manager | Workflow, systems, coverage, volumes | Rarely alone; the sponsor |
| Detection engineering lead | Rule versions, tuning rationale, reviews | No |
| SIEM administrator | Exports, retention settings, access dates | No; access is not authority |
| SOAR or automation owner | Automated closure rules and their history | No |
| General counsel or contracts lead | Client agreements, processing terms, holds | Advises; often gates the decision |
| CEO (provider; often the founder) | Company assets and client relationships | Yes, with counsel |
| CISO (in-house) | The security function's records | No; sponsors the case to the CEO, with legal and the CFO |
What client and legal sign-off usually covers
Three questions recur, and none is the partner's to answer.
- Ownership by record class. Which records are the provider's own work product, and which are client data processed under instruction. The cybersecurity services fit page sets out which security records are usually in scope.
- Identifiers. Alerts carry user names, host names and IP addresses. Under the GDPR, personal data includes information that identifies a person by an identification number or an online identifier. Counsel decides what must be removed or pseudonymized.
- Holds and incidents. Cases tied to litigation or an active incident may be restricted regardless of anything else; see whether litigation hold records can be shared.
For the managed-provider consent side in more depth, see MSP client data licensing and security and whether an MSP can share client ticket data. The data rights explainer covers the general test.
Where the answer stays unknown
With the right executive and counsel engaged, these remain open until SourceX reviews the opportunity: which record classes the company has rights to license, whether any client must consent, what must be de-identified, whether there is dataset demand, and the company's offer.
The introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license the records, and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. Partners sign the Channel Partner Agreement before submitting, and the first valid introduction within the 90-day window is credited when the company submits a verified application.
Before the introduction, the system map of closure records helps the SOC director describe what exists, and the referral brief template gives them a page to forward.
Next step
Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
Once the SOC director has named the executive who can decide and counsel has looked at the client agreements, register as a partner, confirm the company on who qualifies and read the program terms before you make the introduction.