Kit · Governance
Outsourced SOC oversight kit
Detection and response can be bought. Accountability cannot. Outsourcing the function is expressly permitted — what does not transfer is the duty on the organisation's own leadership to ensure compliance and supervise it.
- Transfers
- The work
- Does not transfer
- The accountability
What you are actually buying
You are buying capacity and expertise. You are not buying the disappearance of the obligation, and a supervisory authority will not accept a provider’s name as an answer to why an incident was not detected.
So the SOC Officer’s job in an outsourced model is not smaller — it changes shape. It becomes oversight: defining what must be delivered, verifying that it is, and holding the evidence that proves it.
What to require in the arrangement
Every item here is something people discover they needed during an incident, when it is too late to negotiate.
Ongoing oversight
Trust, then verify — on a schedule, not on suspicion.
The question that reveals everything
Ask a prospective provider: show me a month where you missed something, and what you changed as a result. A provider who cannot produce one has either never missed anything, or does not measure — and only one of those is possible.
Next kit
First 90 days as SOC Officer
A sequenced plan for taking over a SOC: what to establish in week one, what to measure by day 30, and what must be signed by day 90.