SOC

What is a SOC?

A SOC (Security Operations Center) is a team of analysts, processes and technology that continuously monitors an organisation’s IT and OT environment for cyber threats, detects and analyses suspicious activity, and coordinates the response to security incidents. The SOC watches networks, endpoints, servers, cloud, identities and, increasingly, industrial systems, and responds to Malware, Ransomware, data breaches and other attacks. A SOC can be an in-house department, an outsourced service or a combination of both.

A SOC is the digital command centre for Cybersecurity and Incident Response.

🎯 What does a SOC do?

A SOC monitors the networks, systems, applications and OT environments of an organisation and performs the following core tasks:

• Monitoring - continuously collecting and watching Security events, logs and network traffic through tools such as SIEM and EDR
• Detection - recognising suspicious activity based on rules, indicators of compromise, behavioural analytics and anomaly detection
• Triage and analysis - assessing alerts, filtering out false positives and classifying incidents by severity and impact
• Incident response - containing, eradicating and recovering according to the incident response plan, including forensic investigation
• Threat hunting - proactively searching for attackers that slipped past automated detection
• Threat intelligence - turning knowledge of current attacker TTPs into better detection and a sharper security policy
• Reporting - accountability to the CISO and management, and support for regulatory notifications

🧱 How is a SOC team structured?

Most SOCs use a tiered structure of analysts, supplemented by specialists and a SOC manager:

Through automation and AI assistance, routine tier 1 work is increasingly shifting to SOAR playbooks, allowing analysts to focus on more complex incidents.

🔧 Which technology does a SOC use?

Detection rules are increasingly mapped to MITRE ATT&CK, the public knowledge base of attack techniques. This shows which techniques the SOC can and cannot detect.

🧠 Which SOC models exist?

• In-house SOC - own team and own tooling; maximum control and knowledge of the organisation, but expensive and hard to staff
• Outsourced (MSSP or MDR) - a managed security service provider monitors remotely; MDR services (managed detection and response) also carry out the response themselves
• Hybrid SOC - the organisation keeps direction, knowledge and tier 3 in-house and outsources 24/7 monitoring; a widely chosen model according to the SANS SOC surveys
• Virtual SOC (vSOC) - no dedicated facility; analysts work in a distributed way, often partly on call
• Co-managed SOC - own team and provider share the same SIEM platform and playbooks

Not every SOC is staffed 24/7. Smaller organisations often work office hours with an on-call rota outside them, or have a provider cover the night hours.

🔐 How does a SOC work in OT environments?

In OT environments (industrial automation) different rules apply. Availability and safety of the process come first, and many ICS and SCADA systems tolerate neither agents nor active scans. That is why:

• The SOC collaborates with process engineers and ICS/SCADA specialists before intervening
• It relies on passive monitoring and NDR that understands industrial protocols such as Modbus and DNP3
• Knowledge of IEC 62443, the Purdue Model and MITRE ATT&CK for ICS is essential
• It takes account of Real-time processes and production risks; isolating a PLC can shut down a plant

A specialised OT SOC combines this knowledge, often as an extension of the existing IT SOC, so that an attack entering via remote access or the office network can be followed from start to finish.

📏 How do you measure SOC performance?

For the maturity of the SOC as a whole, SOC-CMM is a widely used free model. It was developed in 2016 by Rob van Os and assesses five domains: business, people, process, technology and services. In 2022 MITRE published 11 Strategies of a World-Class Cybersecurity Operations Center, the successor to Ten Strategies from 2014 and a free reference work on setting up and running a SOC.

🏭 When do you need a SOC?

A SOC delivers faster detection and response, a central overview of threats, forensic evidence with a complete incident history and demonstrable compliance with laws and standards. That value is greatest:

• When you fall under the NIS2 directive or the Dutch Cybersecurity Act (Cyberbeveiligingswet)
• With significant OT, remote access or links to suppliers in the supply chain
• For requirements from ISO 27001, the BIO or sector standards that call for logging and monitoring
• When an attack directly affects production, security of supply or safety

NIS2 and the Dutch Cybersecurity Act do not prescribe a SOC, but they do require risk-based measures, incident handling and prompt notification. The Cybersecurity Act has been in force since 15 August 2026. You report a significant incident within 24 hours as an early warning, within 72 hours as an incident notification and within one month with a final report, to the sectoral CSIRT and the supervisory authority via the NCSC reporting point. Without detection capability, that 24-hour deadline is unachievable in practice.

💶 What does a SOC cost and how many people does it need?

Staff are the largest cost item. One position that must be staffed 24/7 requires 8,760 hours a year. A full-time employee delivers around 1,600 to 1,800 productive hours after holidays, sickness and training, so you need five to six FTE per 24/7 position. A minimal in-house 24/7 SOC with one analyst per shift plus tier 2/3, engineering and management quickly reaches ten to fifteen FTE, before licences for SIEM, SOAR and EDR.

A practical approach:

1. Identify the crown jewels - which systems and processes really need monitoring, in IT and OT
2. Choose the model - in-house, outsourced or hybrid, based on budget and available expertise
3. Connect the right sources - start with identity, endpoints, firewalls and Syslog, then OT network monitoring
4. Document playbooks - including escalation to operations and the regulatory reporting deadlines
5. Measure and improve - steer on MTTD, MTTR and ATT&CK coverage and review coverage periodically

🔄 What is the difference between a SOC and a NOC?

Both centres often share data: a sudden spike in network traffic may be an outage, but it may also be an attack.

❓ Frequently asked questions

What does SOC stand for?

SOC stands for Security Operations Center. A SOC monitors an organisation’s digital environment for cyber threats and coordinates the response to incidents. It should not be confused with SOC 2, an audit report on the controls of service providers.

Is a SOC mandatory under NIS2?

NIS2 and the Dutch Cybersecurity Act do not mandate a SOC as such. They do require appropriate measures, incident handling and an early warning within 24 hours of a significant incident. For most organisations, an in-house or outsourced SOC is the practical way to meet those requirements.

What is the difference between a SOC and a SIEM?

A SIEM is technology that collects and correlates logs and generates alerts. A SOC is the team with processes that assesses, investigates and responds to those alerts. A SIEM without a SOC mostly produces unread alerts.

What is the difference between an MSSP and MDR?

An MSSP monitors security controls remotely and usually reports suspicious findings to the customer. An MDR service (managed detection and response) goes further and carries out investigation and response itself, for example by isolating an endpoint. In both models the organisation remains ultimately responsible for reporting incidents.

Can an IT SOC also monitor OT?

An IT SOC can monitor OT if it has OT-specific network monitoring, knowledge of industrial protocols and agreements with operations on how to intervene. Without those additions, the SOC misses attacks on PLCs or intervenes in ways that disrupt production. That is why many organisations add an OT SOC as an extension of their IT SOC.

How many analysts does a 24/7 SOC need?

A 24/7 position requires 8,760 hours a year, which amounts to five to six FTE per position. A small in-house 24/7 SOC therefore quickly needs ten to fifteen staff. That is why many organisations outsource nights and weekends to an MSSP or MDR provider.

📌 In summary

A SOC is the beating heart of your Cybersecurity organisation: it detects threats, investigates them and coordinates the response, in both IT and OT. With SIEM, SOAR, EDR/XDR and NDR, a tiered team and clear KPIs such as MTTD and MTTR, a SOC helps you stop attacks early and meet the reporting deadlines of NIS2 and the Dutch Cybersecurity Act.