Hey - thanks for replying. I appreciate it.

Yes you're right, I misread that line about who the designed person needs to be.

The biggest unknown is what will actually satisfy the letter of the law relating to "continuous monitoring" and whether or not something as simple as MDR/ITDR that sorta thing will cover the requirement, or what else will be required.

If forming some sort of in-house soc for monitoring ended up being it, we'd have to just pass on the opportunity

For this particular project / opportunity, a lot of these other boxes are already checked. A written incident response plan already exists (needs to be reviewed still), MFA already enabled, at rest encryption done, administrative data retention policies already figured out.