SOC mandate builder — SOC Officer

Establishing a mandate from scratch

Take a SOC from having no formal standing to holding an approved, enforceable charter.

One-off

0/16

01Confirm the parent instruments exist and are current — the organisation's information security policy and internal regulations. The mandate points at them.
02Identify the statutory basis and confirm which obligations flow to the SOC, in particular incident notification to the national authority.
03Assign authorship to the CISO, and confirm the approving body is executive management — not IT, and not the security function itself.
04Allocate a document number, set version 1.0, and define validity as running until the review date rather than to a fixed calendar date.
05Draft section 1 with all five assertions: formal establishment; grant of powers; definition of scope, boundaries and functions; the confidentiality-integrity-availability outcome; and designation as the central detection and response unit.
06Draft the four authorities, keeping each qualifying clause intact.
07Enumerate the containment actions, and keep the 'including, but not limited to' framing.
08Write the one-sentence mission: proactive and reactive protection, minimisation of impact on operations, reputation and finances, and assurance of legal compliance.
09Build the in-scope and out-of-scope table, naming the accountable unit for every exclusion.
10Populate the five functional areas, and add the deferral sentence pointing at the service catalogue and the SOPs.
11State the reporting line to the CISO and the accountability standard — 'for its activity and its results'.
12List collaboration counterparts with the subject matter of each: IT infrastructure and operations; legal and compliance; HR; the national authority and peer organisations.
13Write the review clause: not less than annually, plus on material organisational, technological or legal change.
14Add the approval block and the statement that the document enters into force on approval and is valid until the next review.
15Circulate to the units that acquire obligations under the information and change authorities — before submitting for approval.
16Obtain approval, and file the signed instrument alongside the operating model, the service catalogue and the performance measurement procedure.

The four authorities and their load-bearing clauses

Authority	What it grants	The clause not to cut
Monitor and analyse	Continuous monitoring of the entire estate — networks, servers, endpoints, cloud	Name all four environment classes. Omitting cloud is how cloud ends up unmonitored.
Respond to incidents	Technical action to contain the threat and limit impact	The confirmed-incident precondition, and the non-exhaustive framing of the action list.
Demand information	Access to logs, configurations and technical information for investigation	The obligation on all units to cooperate. Without it, the authority is a request.
Initiate change	Recommendations to system owners on gaps, configuration and controls	That the recommendations are mandatory to act on or formally decline — and addressed to named system owners.

Annual mandate review

Confirm the mandate still describes the organisation it governs.

Annual

0/8

01Has the estate changed? New cloud tenancies, new subsidiaries, new business lines.
02Has anything moved between the in-scope and out-of-scope columns without the document being updated?
03Are the named collaboration counterparts still the right ones, and do the named people still exist?
04Has the legal basis changed — new legislation, new supervisory guidance, new classification?
05Did any incident in the last year expose a gap between the mandate and what actually happened?
06Was the pre-authorised containment authority used? If never, find out why — it may not be trusted.
07Is the reporting line still accurate after any reorganisation?
08Re-approve, re-version and re-date. A mandate that is 'still fine' should still be re-signed.

Keep the operational detail out

The mandate is deliberately short so that it can be read by executives and cited in disputes. Response times, service lines, playbooks, tool names and staffing all belong in the service catalogue and the SOPs — documents that can change without a board meeting.

The four authorities and their load-bearing clauses

Triage & escalation kit