Standard
Security Operations Centre Operating Model Standard
This standard defines the operating model for the security operations centre (SOC). It covers capability tiers, staffing model, tool stack, coverage hours, detection engineering, threat hunting, intelligence integration, on-call governance, shift handover, MTTD and MTTR targets, and the supplier-managed-SOC model where one is used.
- Type
- Standard
- Version
- 1.2.0
- Date
- 2026-10-15
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material change to capability tier, supplier model, or detection portfolio
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Capability tiers
- 4. Staffing model
- 5. Tool stack
- 6. Coverage hours
- 7. Detection engineering
- 8. Threat hunting
- 9. Intelligence integration
- 10. On-call and shift governance
- 11. Metrics and SLAs
- 12. Supplier-managed-SOC
- 13. Continuous improvement
- 14. Framework alignment
- 15. Limitations
Frameworks it maps to
- NIST CSF 2.0
- NIST SP 800-61 Rev. 3
- NIST SP 800-150
- NIST SP 800-92
- ISO/IEC 27001:2022
- ISO/IEC 27035 series
- MITRE ATT&CK
- MITRE D3FEND
- SOC-CMM
- FIRST CSIRT Services Framework
Related documents
- Logging and Monitoring Standardsecurity
- Security Incident Response Proceduresecurity
- Incident Escalation Matrixsecurity
- Security Ticket Reporting Schemesecurity
- Security Monitoring and Alert Management Procedureoperations
- Threat Intelligence and SIEM Operations Procedureoperations
- Penetration Testing and Red Team Standardsecurity
- Cross-Domain Incident Coordination Procedureresilience
- AI Incident Response Planai
Next
All Documents