Security Operations Center (computing) - Organization

Organization

Large organizations may operate more than one SOC to manage different groups of information and communication technology or to provide redundancy in the event one site is unavailable. SOC work can be outsourced, for instance by using a Managed security service. The term SOC is normally used by governments and managed computer security providers, although a growing number of large corporations and other organizations also have such centres.

The SOC and the network operations center (NOC) complement each other and work in tandem. The NOC is usually responsible for monitoring and maintaining the overall network infrastructure—its primary function is to ensure uninterrupted network service. The SOC is responsible for protecting networks, as well as web sites, applications, databases, servers and data centres, and other technologies.

Likewise, the SOC and the physical security operations center (SOC) coordinate and work together. The SOC is a facility in large organizations where security staff monitor and control security officers/guards, alarms, CCTV, physical access, lighting, vehicle barriers, etc.

In some cases the SOC, NOC or SOC may be housed in the same facility or organizationally combined. Typically, larger organizations maintain a separate SOC to ensure focus and expertise. The SOC then collaborates closely with network operations and physical security operations.