We can all agree it's best practice to implement a SOC within an organization, but are there any frameworks or compliance requirements that specifically call it out?


In the PCI DSS, section 12.5.2 calls out the requirement to assign responsibilities to a person or team to "Monitor and analyze security alerts and information, and distribute to appropriate personnel."

It may not be spelled 'SOC', but it matches the definition.

  • But that requirement can also be met with a single part-time person. And that's not a SOC. – schroeder Aug 13 '18 at 7:50
  • Whether or not the SOC is properly sized is up to the QSA. The DSS just says someone has to be responsible for those duties. – John Deters Aug 13 '18 at 12:54
  • My point is: is a single part-time employee a "SOC"? I get the "monitoring" part (see my answer). I'm trying to get to, is that a SOC, and then, does the PCI-DSS description constitute a SOC? – schroeder Aug 13 '18 at 12:55
  • The answer seemed to satisfy the person who asked the question. I think arguing whether or not a certain threshold should receive a special label is trivial and counterproductive to helping them. – John Deters Aug 13 '18 at 12:59

I disagree with your premise.

"Monitoring" is required by many frameworks and regulatory requirements, but I'm not sure there is value in specifying the overhead of a SOC to implement monitoring so specifically.

Setting up a SOC is a natural consequence of being compliant with the various frameworks. In order to be consistent, to have staff on hand to respond, and having repeatable and consistent processes for monitoring and response can be done in a variety of different ways. Once the number of things to monitor, the number of events, and the number of incidents reaches a critical point, the natural next step is setting up a SOC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.