UMMIM | SERVICE RESPONSIBILITY CHECKLIST
5 November 2026 | UMMIM interpretation

For one service, record the managed provider, partner, retained customer owner, decision authority and evidence/gap for every item.

1. Service outcome and scope
Which user or business outcome is supported? Mark included domains, service hours, locations and exclusions. Name the owner who accepts the service promise.
Evidence to bring: Service description; supported estate; measurable acceptance criteria.
Managed provider: __________
Partner: __________
Customer owner: __________
Decision authority: __________
Evidence/gap/owner: __________

2. Managed, partner and customer work
For each activity, name the managed provider, any partner and the retained customer owner. Distinguish delivery responsibility from approval authority; a supplier dependency is not transferred merely by naming a prime.
Evidence to bring: Responsibility matrix; partner commitments; customer prerequisites.
Managed provider: __________
Partner: __________
Customer owner: __________
Decision authority: __________
Evidence/gap/owner: __________

3. Telemetry and evidence
Who can see network, endpoint, identity and cloud events? Agree data ownership, access, retention, correlation and the evidence available to the customer. Record monitoring gaps.
Evidence to bring: Logging map; access test; reporting example; named gap owner.
Managed provider: __________
Partner: __________
Customer owner: __________
Decision authority: __________
Evidence/gap/owner: __________

4. Privileged access and change
Who can grant, use, revoke and review privileged access? Who authorises emergency isolation, policy changes and rollback across domains?
Evidence to bring: Access approvals; emergency procedure; revocation and rollback tests.
Managed provider: __________
Partner: __________
Customer owner: __________
Decision authority: __________
Evidence/gap/owner: __________

5. Incident lead and escalation
Who leads an incident that spans connectivity and security? Specify the first responder, customer decision-maker, partner escalation, out-of-hours coverage and communications owner.
Evidence to bring: Cross-domain scenario; contact path; escalation acceptance; decision log.
Managed provider: __________
Partner: __________
Customer owner: __________
Decision authority: __________
Evidence/gap/owner: __________

6. Recovery and continuity
Who restores the underlay, security policy, identity and application dependencies, and in what order? Agree recovery assumptions and what happens when a partner is unavailable.
Evidence to bring: Dependency map; recovery exercise; tested hand-offs; unresolved risks.
Managed provider: __________
Partner: __________
Customer owner: __________
Decision authority: __________
Evidence/gap/owner: __________

7. Transition and acceptance
Who proves that monitoring, support and partner access work before responsibility transfers? Define who can accept residual risks or refuse service entry.
Evidence to bring: Acceptance test; onboarding evidence; named sign-off owner; exception list.
Managed provider: __________
Partner: __________
Customer owner: __________
Decision authority: __________
Evidence/gap/owner: __________

8. Exit and portability
Who returns configurations, logs and documentation, removes access and supports transfer to a replacement provider? Agree dependencies, timescales and commercial terms.
Evidence to bring: Exit plan; export test; access-removal evidence; partner obligations.
Managed provider: __________
Partner: __________
Customer owner: __________
Decision authority: __________
Evidence/gap/owner: __________

Decision: proceed / narrow the promise / hold for named evidence.
Not a certification or legal scope determination.
https://ummim.com/insights/who-owns-the-outcome.html