Question 1

What is a SOC (Security Operations Center)?

Accepted Answer

A SOC (Security Operations Center) is a centralized team responsible for monitoring, detecting, analyzing, and responding to cybersecurity incidents within an organization. A SOC combines people, processes, and technologies (SIEM, EDR, SOAR) to provide continuous protection of IT infrastructure. It can be internal or outsourced (Managed SOC).

Question 2

What is the SOC-CMM maturity model?

Accepted Answer

SOC-CMM (Security Operations Center Capability Maturity Model) is a framework for assessing the maturity of security operations. It defines 5 maturity levels: Initial (ad-hoc), Managed (basic monitoring), Defined (documented processes), Measured (metrics and threat hunting), and Optimizing (continuous improvement). The assessment covers domains: people, technology, processes, threat intelligence, and metrics.

Question 3

What are the key SOC metrics?

Accepted Answer

Key SOC metrics include: MTTD (Mean Time to Detect) — average time to identify a threat, MTTR (Mean Time to Respond) — average time to respond to an incident, number of incidents detected and handled, false positive rate, detection coverage against MITRE ATT&CK framework, and triage time. A mature SOC tracks these metrics and regularly reports them to management.

Question 4

Managed SOC vs in-house SOC — which to choose?

Accepted Answer

An in-house SOC provides full control but requires significant investment in people (L1/L2/L3 analysts), technologies (SIEM, EDR, SOAR), and processes. A Managed SOC (SOC-as-a-Service) provides 24/7 monitoring, access to experts and tools without building your own team. For most organizations, a hybrid model or Managed SOC with a dedicated account manager is the optimal solution.

SOC Maturity Assessment

Your SOC Maturity Level

Strengths

Areas for Improvement

Need help building or improving your SOC?