I have received this question from a few clients, but I have 0 experience building a 24x7 SOC.

  • This depends immensely on size of the organization, complexity and number of systems, usage patterns, level of required/actual security, etc. Can you add some more details?
    – AviD
    Nov 16 '10 at 6:00
  • 2
    I ‘ve gotten this question a few times from organizations with one or two security engineers. It is usually sparked by a series of security incidents that pushes them to want to move to 24x7 coverage. The goal of this question is to answer the number of people (with defined roles) and budget to squeeze out a running 24x7 SOC. The # of systems, complexity, and other details is hidden – of course this implies the client is able to prioritize his skeleton SOC to monitor what’s most important. Nov 16 '10 at 17:46
  • One important aspect of that question is where you want your SOC to be established, because at the end this mainly comes to how much people you need to run it, and people cost varies greatly on where you are. The where question is not just a money matter of course, many other things are involved like legal aspects, risk management, quality etc.
    – ack__
    Feb 21 '14 at 11:36
  • mitre.org/publications/all/…
    – atdre
    Jan 9 '15 at 21:00

As the others mentioned this can only be established when you know more requirements.

These might include but not be limited to:

  • Region
  • 24x7?
  • scale/type of work involved. (I.e. how much work/ how often ?)

For a rough idea you could sketch out how the current incidents you mentioned would've been ideally dealt with, and how much work this would've taken from how many people - with generous estimates as always on time actually required.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.