Shift & handover kit — SOC Officer

Start of shift

Before touching the alert queue, confirm the queue is telling you the truth.

Per shift

0/8

01Read the previous shift's handover record in full, including items marked 'no action'.
02Confirm log-source health: no collector silent, no source below its expected volume.
03Check detection platform availability and any degraded components.
04Review incidents still open, and specifically any approaching a response target.
05Note environment changes in flight — planned maintenance, deployments, migrations — that will generate expected noise.
06Confirm who is on escalation for this shift at L2, L3 and management, and that their contact details are current.
07Check for any suppression or exclusion that expires during this shift.
08Acknowledge the handover in the record so the previous shift can close out.

End of shift — the handover record

Write it for someone who was not here and cannot ask you a question. That is the actual test.

Per shift

0/9

01Every incident opened during the shift, with its current state and next action.
02Every incident escalated, to whom, at what time, and why.
03Anything closed that a reasonable person might have escalated — with the reasoning.
04Watch items: things not yet an incident but worth a second look next shift.
05Environment changes observed, including any that were not announced in advance.
06Detection anomalies: rules that fired unusually often, or unusually not at all.
07Any suppression applied during the shift, with its expiry.
08Outstanding requests to other teams, with when they were made and by whom.
09Confirm the record is filed in the system, not sent in a chat message.

Escalation contact matrix — the fields it must carry

Field	Why it exists
Role, not just name	People leave. Roles persist, and the rota can be reassigned.
Primary and secondary contact	A single point of contact is a single point of failure at 03:00.
Contact method and a fallback	The primary method may be the thing that is compromised.
Out-of-band channel	If the estate is untrusted, you cannot coordinate the response inside it.
Authority held	Who can approve containment, who can approve a notification, who can approve spend.
Expected response time	So that a non-answer becomes a defined escalation, not a wait.
Last verified date	An untested contact path is an assumption. Test quarterly.

Test the path, not the list

Quarterly, actually call the out-of-hours number. Most on-call failures are not people refusing to answer — they are a number that was reassigned, a rota that was not updated, or an alerting integration that silently stopped delivering months ago.

Designing on-call that people can sustain

An on-call rota that burns people out becomes a rota nobody answers. Design for the second year, not the first month.

On setup, then annually

0/8

01Define what actually warrants waking someone — write it down, and be strict.
02Ensure the on-call person has the authority to act, not only to observe and escalate further.
03Provide the playbooks in a form usable at 03:00: short, specific, no assumed context.
04Give a defined path to a second person, and make it socially acceptable to use it.
05Compensate the burden, and track how often the rota is actually invoked.
06Rotate so that no single person carries the critical knowledge or the critical weeks.
07Review every out-of-hours call after the fact: was waking someone the right call?
08Treat a rising out-of-hours call rate as a detection quality problem, not a staffing problem.

Escalation contact matrix — the fields it must carry

Detection engineering kit