Security services are the building blocks for your security packages. They include the actual security components themselves, are linked to the tools in your security stack and include all of the costs you incur in the licensing and provisioning of the security service. Each service you create will be aligned to the NIST Cybersecurity Framework 2.0 so your clients can easily visualise what your security offerings 'look like' and how they will enhance their security.

Security services are extremely flexible. They can be as complex as a full security package or as simple as a single security feature such as Email Protection.

We have deliberately engineered security services so you can design and build your security services independently from how you sell them. This ensures your technical team can engineer the security capabilities of your security services and ensure stack alignment whilst your sales team can close sales without worrying about overpromising or under-pricing solutions.

Regardless of how you decide to build your security services, you must add them to a security package in order to sell them to a client.

Features of your security service should closely mirror the technologies (e.g. endpoint protection) and practices (e.g. incident response handling) that the service provide, although you can be much more specific if the service has particularly important technical features or benefits that want to highlight.

The features you add are not linked to the security capabilities of the security services and therefore will have no impact on the NIST CSF Alignment of the security service or 'predicted scores' of any security packages that you add the service to.

Feature functionality includes:

To ensure your security services are aligned to international security standards and are easy for your clients to understand and trust, HighGround aligns all security services to the NIST Cybersecurity Framework 2.0 (NIST CSF). This alignment has been achieved by converting the NIST CSF subcategories (aka security controls) in the following way:

All NIST questions are aligned with Security components, which are easily recognisable as the technologies and practices you deliver to your clients.

As part of building your security services, you must answer the NIST service questions. Since these are linked to security components (and thus the scoring engine - read more below), answering these questions will give your security service it's security posture.
​

To get started, click on any of the sections on the left to load the NIST security questions:

Across the top is a tab for the following NIST CSF Functions: Identify, Protect, Detect, Respond and Recover. The Service questions are grouped into these sections, although you may find it much easier to use the search at the top (when searching, the NIST Function will be shown as a tag on each question for ease).

Simply click 'Yes' to the the functionality that your security service will provide and you will see the NIST CSF chart on the right hand side dynamically change. When done, click 'Save'.

Note: HighGround covers the Governance Function with the CyberResilience KPI, Governance & Resilience module and overlaps with the Identify Function.

Security components are likely to be more recognisable to you - these are the core technologies and practices you are likely already delivering to your service, and the things you likely refer to by the tool name rather than the technology itself.

Security components is the central cog in HighGround and are interconnected to almost every part, most notably: . Not only are they linked to the NIST CSF service questions when building your security service, they are also directly connected to:

You can see the security components included in a security service in the security component block:

Whilst the primary way for a security component to be added to a security service is through answering the NIST CSF service questions, they can also be added manually by clicking 'Add' at the bottom of the Security component block, triggering a dropdown:

After you have added the security components to your security service, you need to map the following:

Security Pillar: this is used to provide an alternative view for your clients when presenting your security packages, adding depth and augmenting the default NIST CSF Function view. Select from:

​Products: link the security component to a product (via your stack or directly to a product). Alternatively you can link it to 'labour' if it is a practice (i.e. a service you provide):

When linking a technology to a tool in your security stack, you will be prompted to select the exact product(s) you want to use. If no product has been linked, you will be presented with all products, enabling you to search, select and link a product to your tool.

Once you click add, the product will be linked to the security component and also added to your costs section below to ensure you price your security service correctly and have visibility on your profitability.
​

Now you are ready to complete the pricing part of your service!

Security services have their own billing models, which are then aggregated when added to a security package. There are several billing parameters you must define:

Add your service costs to ensure you are billing your security services profitably. There are 2 types of costs you can add:

Product costs: any products associated with security components will be automatically added. You can manually add product costs as well.

Labour costs: almost every service you provide has a service cost attached. Even if its 2 minutes - capture it - it's better to account for something and manage your cost base, rather than let it eat into your margins.

​Pricing changes

Since pricing is always changing, HighGround continuously monitors for changes in pricing as follows:

When a pricing change is detected, HighGround will add a label beside these costs to notify you, and a blue 'Update' button to update the pricing of your service.

If you select 'Update', you will be notified of all Security Packages this security service has been used in and therefore which security packaged will be affected by the pricing update.

A summary of the security service pricing is provided at the bottom. When doing the complex work of building security services, it is easy to lose sight of the most important part for your MSP - making an adequate profit to make the effort worthwhile!

To help with this, HighGround will display the sell price, aggregate your total product and labour costs, and calculate your margin and margin %.

You can return to edit your security service at any time. If you change anything that will affect a security package that the security service has been included in, HighGround will prompt you about this, giving you an opportunity to change your mind.

Below are some additional security service management features you may find useful:

Duplicating a Security service:
​

To duplicate a security service, start by finding the service you wish to duplicate. From here, select the three dots at the end of the service and choose 'Duplicate'.
​

Your duplicated service will now automatically show in your lost of services.

Deleting a Security service
​

If at any time you decide you no longer need one of your services you can delete this from your list of services. Find the service you are looking to delete and from the three dots at the end of the service select 'Delete'.

You will see a prompt asking if you are sure - click yes and your service will be removed from the list.