Cybersecurity Consulting
SOC Setup and Incident Response Planning
We design your in-house SOC team’s roles, alert flow and response procedures with you. We test your incident response plan in an initial exercise.
What it is
SOC setup defines where an alert starts and where it is closed. The work covers roles, shift patterns, alert priorities and escalation rules. The incident response plan specifies who makes decisions and who is informed in a serious incident. The design is based on incident response recommendations in NIST SP 800-61 Rev. 3 and adversary techniques in MITRE ATT&CK.
Scope
- SOC roles, shift pattern and escalation matrix
- List of log sources and alert priorities based on priority threat scenarios
- Response procedures (playbooks) for common incident types
- Incident response plan with decision rights, communication and regulatory notification steps
- Metrics to track detection and response times
- First test of the plan in a tabletop exercise
The need
When organizations need it
- When you have invested in SIEM and EDR but roles and alert handling order are not defined.
- When you decide to transition from an outsourced monitoring service to your own SOC team.
- When a financial regulator requires your incident response plan to be tested at least annually.
Method
How we work
-
Threat scenarios
We select attack techniques targeting your sector from MITRE ATT&CK. Log and alert priorities are based on this selection.
-
Operating model
We define roles, shifts and escalation rules according to your organization’s size.
-
Procedures and plan
We write the response procedures and incident response plan. Regulatory notification steps and deadlines are included in the plan.
-
Exercise
We test the plan in a tabletop exercise with a realistic scenario. The plan is revised based on any issues identified.
Outcome
What you have at the end
Your SOC team starts work knowing who handles each alert and within what timeframe. Your incident response plan has been tested in an initial exercise and revised.
Frequently asked questions
Should we build our own SOC or use a service?
This depends on your log volume, monitoring hours and ability to hire specialists. We compare the options with you. In a hybrid model, we also define which work is assigned to whom.
Do regulations require an incident response plan?
Financial regulators often require an incident response plan that is tested at least once a year. We write the plan to meet your regulatory reporting deadlines.
Is the exercise run on live systems?
The first exercise is a tabletop and does not affect live systems. Testing the technical team with a controlled attack simulation can be planned separately.
Cybersecurity Consulting
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting