A tender may ask for security-monitoring capabilities, and an incident may prompt a review of threat detection. Before choosing an internal, outsourced or hybrid SOC, define your risks, applicable duties and required coverage. NIS2 does not require every SME to purchase a SOC.
We explain what a SOC is, how it relates to MDR, MSSP and SIEM, and what to review when deciding whether it suits your business.
What is a SOC in cybersecurity?
A SOC (Security Operations Center) is a unit —physical, virtual or hybrid— that combines people, processes and technology to continuously monitor, detect and respond to cybersecurity threats. Usually 24/7.
A useful analogy is the control tower at an airport: it does not fly the planes, but it makes sure they do not collide, coordinates the right people when there is an emergency and keeps everything under control. A SOC does not manage your infrastructure either. It monitors what happens inside it and activates protocols when something smells wrong.
In Spain, the term COS, Centro de Operaciones de Seguridad, is also used. The CCN-STIC 896 guide addresses a compliance profile for managed security services and SOC maturity levels; using the label does not establish certification.
"A SOC IS NOT A TECHNOLOGY.
IT IS A TEAM THAT SUSTAINS A PROCESS."
What a SOC actually does, step by step
When a provider sells you a SOC, they are selling you a continuous five-stage process. Not a piece of software.
Continuous prevention
The SOC uses asset inventories and vulnerability information to guide monitoring. Patching, configuration changes and policy updates must be assigned to the responsible team within the agreed scope; they are not automatically included in every SOC service.
Detection and monitoring
SIEM and EDR/XDR provide logs and signals for detecting suspicious activity. Alerts depend on connected sources, rules and tuning. An unusual login time or large transfer needs context; not every anomaly is detected or indicates an attack.
Investigation and triage
Not every alert is an attack. The L1 analyst filters out noise. If it looks serious, it escalates to L2, who investigates the context. If the incident is complex, an L3 analyst takes over for proactive threat hunting and forensics.
Response and containment
For a confirmed incident, the team applies the agreed procedure: it may isolate devices, block connections, revoke credentials and preserve evidence. Prompt action can limit impact; it does not establish a universal ratio between response time and incident cost.
Recovery and learning
After containment, systems have to be restored, persistence has to be ruled out and everything must be documented. The least visible but most valuable part: each incident updates the playbooks, detection rules and controls. So the same thing does not happen again.
The three pillars: people,
processes, technology
A SOC that does not balance all three is not a SOC. It is an expensive dashboard.
People
L1 analysts (triage, 24/7), L2 analysts (deep investigation), L3 analysts (incident response and threat hunting), plus a SOC manager and often detection engineers who fine-tune the rules. In SMEs using an outsourced SOC, this team sits with the provider, not on your payroll.
Processes
Playbooks, response commitments, escalation and communication with the appropriate recipients for the incident. For significant incidents, NIS2 Article 23 generally provides for early warning within 24 hours and notification within 72 hours of awareness, with exceptions and a later final report. The applicable national framework must be checked. Source: NIS2 Directive.
Technology
SIEM as the core (Splunk, Microsoft Sentinel, Elastic, Wazuh), SOAR to automate repetitive responses, EDR/XDR on endpoints (SentinelOne, Microsoft Defender for Business, Sophos), threat intelligence feeds and ticketing for traceability. Without technology there is no SOC. With technology alone, there is not one either.
SOC vs MDR vs MSSP vs SIEM: they are not the same
These terms describe functions, services and tools that can overlap. Comparing the contractual scope helps distinguish a platform from the team and procedures that use it.
| Concept | What it is | What it includes | Who buys it |
|---|---|---|---|
| SOC | Function / organisational unit | People + processes + technology (everything) | Companies that want full operational cybersecurity capability |
| MDR Managed Detection & Response |
Outsourced commercial service | Detection + active response, focused on endpoints and network | SMEs and mid-sized companies that need 24/7 capability without building their own SOC |
| MSSP Managed Security Service Provider |
Managed security service provider | May offer SOC, MDR, managed firewall, pentesting, audits… | Companies that outsource security layers under contract |
| SIEM Security Information & Event Management |
Technology platform (software) | Log collection and correlation + alerts | Internal SOCs or providers that build detection on top of it |
A SIEM is a tool; a SOC is an operational security capability; MDR is a managed detection and response service, and MSSP describes a managed security provider. Commercial labels alone do not define scope. Ask which sources are monitored, who responds, during which hours and with what authority to act.
SOC models: internal, outsourced
or hybrid
Internal SOC (dedicated)
Your own team, infrastructure and tools. Feasibility depends on risk, workload, shifts, absences, specialist skills and budget. No universal company-size threshold or analyst count guarantees a viable 24/7 SOC.
Outsourced SOC (SOCaaS)
You contract the defined services and coverage from a provider. Pricing may depend on devices, data volumes or scope. This offers access to a shared team without building every capability internally; compare costs, responsibilities and dependencies.
Hybrid SOC (co-managed)
Your internal IT team handles day-to-day operations. The provider adds 24/7 monitoring, threat hunting and out-of-hours response. It is usually the most efficient model for companies with competent internal IT but no shift capacity. At IslaNet, it is the model we most often recommend for SMEs with 50-250 employees in the Balearic Islands.
Does your SME need a SOC? Four clear scenarios
These four scenarios justify reviewing detection and response capabilities. The appropriate solution may be internal, managed or combined and should fit the specific risks and requirements.
Your sector is covered by NIS2
If the activity matches NIS2 entity types, review size, exceptions and applicable national law. Article 21 requires measures proportionate to risk, not a universal SOC purchase. A SOC may support detection and response, but does not establish compliance by itself or replace the entity's responsibility.
Your clients or suppliers are asking for it
A contract or tender may require specific monitoring, response and evidence. Check its scope and award criteria: a SOC may help satisfy a requirement, but cannot guarantee winning the contract.
You have suffered an incident and do not want another one
After an incident, review missing signals and how alerts were handled. A SOC can improve detection and response, but cannot guarantee discovering every attack before it causes damage.
You operate in a high-risk sector
Hotels, healthcare organisations, logistics, finance and professional firms handle systems or information whose loss or exposure can have serious consequences. Assess impact and likelihood in your case; a successful attack is not inevitable.
How to choose a SOC provider: a practical checklist
If you have already decided to outsource, these are the seven criteria that separate a real SOC from one that only sells the badge.
Response SLAs written into the contract
Maximum time to acknowledge, analyse and contain by severity level. If the SLA is not in writing, it does not exist.
Real 24/7 coverage you can verify
Ask how many analysts are on each shift, where they work from and how they prove night-time coverage. A "24/7" SOC with two analysts in total is not 24/7.
Provider and team certifications
Check the scope and validity of relevant certifications, such as ISO 27001 or ENS, and SOC 2 assurance reports where applicable. SOC 2 is an audit report, not an ISO certification. Also assess staff experience and credentials against the service you are buying.
Transparency around the technology stack
Ask about SIEM, EDR, intelligence sources and third-party dependencies. The provider should explain its architecture and responsibilities in enough detail to assess the service while respecting necessary confidentiality limits.
Integration with your current stack
Microsoft 365, Google Workspace, ERP, CRM, firewalls and cloud services can provide useful logs. Identify which sources are integrated and which are excluded: missing visibility makes investigation harder, but does not establish where an attack will occur.
Executive reporting, not only technical reporting
Monthly reports that management can actually read: incidents detected, mean time to containment, maturity. If reporting is just a sheet full of alerts, management loses context and the SOC loses internal sponsorship.
Real response exercises
Regular tabletop exercises with management and at least one annual purple team. A SOC that never tests you leaves you not knowing whether it works until the worst has already happened.
Primary sources: CISA StopRansomware · NIST SP 800-61r3 · NIS2, arts. 2, 21, 23.
FAQs
about SOCs
"We are small, no one is going to attack us"
Size does not remove risk. An SME may face credential theft, fraud or service disruption. Assess its assets, exposure and controls rather than using a general attack percentage as a diagnosis of the business.
"We already have an IT person, why would we need a SOC?"
They are different things. Your IT person manages systems: making sure they work, stay up to date and allow people to do their jobs. A SOC monitors security 24/7 with specific tools and processes. They do not replace each other; they complement each other. A SOC usually works on top of the infrastructure your IT team already maintains.
What is the difference between a SOC and a NOC?
A NOC focuses on the availability and operation of networks and services; a SOC focuses on detecting, investigating and responding to security threats. They may share data and coordinate. Check which security tasks your IT provider actually includes.
Can I build an internal SOC with 2-3 people?
Two or three people alone are unlikely to cover every shift, rest period, holiday and specialist role in a staffed 24/7 operation. Size the coverage and backup arrangements through an actual staffing plan. An outsourced or hybrid model may supply additional capacity according to its contract.
What are SOC L1, L2 and L3 analysts?
L1 performs the initial triage of alerts and filters false positives. L2 investigates anything that looks suspicious, correlates events and escalates if it is a real incident. L3 handles complex incident response, digital forensics and proactive threat hunting. The career path starts at L1 and evolves with experience and certifications.
Does a SOC replace antivirus or firewall protection?
No. A SOC uses signals from sources such as endpoints, firewalls, identity, email and cloud services. Tools and review processes complement each other. Alerts may also be reviewed outside a formal SOC; responsibilities, coverage and actions should be clearly assigned.
Do you subcontract the SOC to another country?
At IslaNet, no. We manage the SOC from Palma with our own technicians. When a critical alert fires at 3 a.m., one of our technicians in Mallorca picks up —not an operator in another time zone and not a generic call centre.
Does NIS2 require every SME to have a SOC?
There is no universal requirement for every SME to purchase a SOC. NIS2 scope depends on activity, size, business relationships and exceptions; supplier status does not automatically make a business a regulated entity. Applicable national law must be checked. A SOC may support detection and response measures, but does not establish compliance by itself. A cybersecurity audit can help assess the case.
IF YOU NEED A SOC, LET’S TALK
If your company is considering hiring a SOC —internal, outsourced or hybrid— we can help you decide. No pressure sales. A short call is enough for us to understand your case, see which model fits your size and sector, and give you a realistic investment range.
