I have received this question from a few clients, but I have 0 experience building a 24x7 SOC.

  • This depends immensely on size of the organization, complexity and number of systems, usage patterns, level of required/actual security, etc. Can you add some more details?
    – AviD
    Commented Nov 16, 2010 at 6:00
  • 2
    I ‘ve gotten this question a few times from organizations with one or two security engineers. It is usually sparked by a series of security incidents that pushes them to want to move to 24x7 coverage. The goal of this question is to answer the number of people (with defined roles) and budget to squeeze out a running 24x7 SOC. The # of systems, complexity, and other details is hidden – of course this implies the client is able to prioritize his skeleton SOC to monitor what’s most important. Commented Nov 16, 2010 at 17:46
  • One important aspect of that question is where you want your SOC to be established, because at the end this mainly comes to how much people you need to run it, and people cost varies greatly on where you are. The where question is not just a money matter of course, many other things are involved like legal aspects, risk management, quality etc.
    – ack__
    Commented Feb 21, 2014 at 11:36
  • mitre.org/publications/all/…
    – atdre
    Commented Jan 9, 2015 at 21:00

1 Answer 1


As the others mentioned this can only be established when you know more requirements.

These might include but not be limited to:

  • Region
  • 24x7?
  • scale/type of work involved. (I.e. how much work/ how often ?)

For a rough idea you could sketch out how the current incidents you mentioned would've been ideally dealt with, and how much work this would've taken from how many people - with generous estimates as always on time actually required.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .