Kit · Governance

Service catalogue kit

Most disputes about a SOC are not about performance — they are about expectation. The service catalogue is the document that makes what you deliver explicit, including what you deliberately do not.

Output: Published service catalogue
Reviewed: Annually or on scope change

All kits

Define the demarcation first

The single most valuable page in a service catalogue is the routing table. Half of a SOC’s wasted capacity arrives as work that belongs to the IT service desk, and every hour spent on a password reset is an hour not spent on triage.

Publish the table, agree it once with the service desk, and route by it thereafter. The argument only has to be had one time.

Routing — SOC or service desk

Request type	Goes to	Examples
Security incident	SOC	Malicious software, data leakage, unauthorised access, phishing, denial-of-service
Security request	SOC	Advice on secure deployment, checking a suspicious email, questions about security policy
IT problem or fault	IT service desk	Printer failure, software installation faults, connectivity disruption, password reset
IT request or service	IT service desk	Ordering software, granting access rights, preparing equipment

Defining a service line

Every service in the catalogue needs all of these, or it is an aspiration.

Per service

0/9

01A one-sentence description of what the recipient actually gets.
02The coverage window — and whether that means staffed, or on-call.
03The response commitment per severity, stated in the units it will be measured in.
04The tier that delivers it: L1, L2, L3, or a specialist partner.
05The prerequisites the recipient must meet for it to work at all — log sources, access, contacts.
06The deliverable: what artefact the recipient receives, and when.
07The explicit exclusions — what a reasonable person might assume is included but is not.
08The measurement: which KPI evidences this service, and how it is calculated.
09The escalation path when the commitment is missed.

Response commitments — a starting model

Severity	Definition	Response	Notification channel
A — Critical	The service or a core function does not work, or repeatedly fails with material impact on operation	Up to 2 hours during service hours	Email and telephone — both
B — High	Functionality impaired or difficult; the service is usable but hard to use, or data accuracy is uncertain	Up to 4 hours during service hours	Email and/or telephone
C — Normal	Minor degradation, or minor issues requiring a parameter check or change	Up to 1 working day	Email and/or telephone

Service hours must be stated explicitly — for example 08:00–18:00 on working days. A response commitment without a stated coverage window is unmeasurable.

Two severity scales, and they are not the same

The scale above governs your service commitment. The statutory impact categories govern your regulatory obligation. An incident can be severity C for the service and still be a high-impact incident for the regulator. Assign both, on every incident, and never let one be derived from the other.

Next kit

Evidence & forensics kit

Collection order, chain of custody, integrity verification and retention — the discipline that decides whether your investigation stands up later.

Open Evidence & forensics kit