Security operations centre (SOC)
A security operations centre (SOC) is a team, in-house or outsourced, that watches an organisation's systems for signs of attack and responds when something suspicious happens. Cyber Essentials does not require a SOC or any security monitoring. The scheme sets five preventive controls; a SOC is a further layer on top.
- Term
- Security operations centre
- Also known as
- SOC, Security operations center
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term security operations centre mean in Cyber Essentials?
A security operations centre (SOC) is a team, in-house or outsourced, that watches an organisation's systems for signs of attack and responds when something suspicious happens.
How does security operations centre apply to Cyber Essentials?
In plain terms
A SOC is the security control room. Alerts from laptops, servers, firewalls and cloud accounts feed into one place, and trained analysts decide which ones matter, investigate and act, for example by isolating an infected laptop or locking a compromised account. Small organisations rarely run their own. They buy it as a managed service, often alongside endpoint detection and response.
What Cyber Essentials asks
Nothing directly. The five controls, firewalls, secure configuration, security update management, user access control and malware protection, are about stopping common internet-based attacks from succeeding in the first place. None of them requires logging, monitoring or an incident response team, and no Danzell question asks about them.
Two questions sit nearby:
- A1.16 asks whether you have signed up to the NCSC's free Early Warning service. It is in the organisation section, not one of the five controls.
- A7.13 asks whether you have a process for when passwords or accounts may have been compromised. That is a response step, but it is about changing passwords promptly, not about watching for attacks.
Worth knowing
Preventive controls cannot tell you when something has gone wrong. A SOC can. For most small organisations, getting Cyber Essentials right comes first, and monitoring is the next layer once the basics are in place. Precursor Security is CREST accredited for SOC and runs a SOC service, separate from certification.
See A1.16 and A7.13. Related: managed service provider, commodity attacks.
Related terms
- EDR (endpoint detection and response)Endpoint detection and response (EDR) is security software on each computer that records activity, spots suspicious behaviour and helps someone stop an attack.
- Managed service provider (MSP)A managed service provider (MSP) is an outside company you pay to run or support your IT.
- Commodity attacksCommodity attacks are cheap, widely available attacks, run with off-the-shelf tools against many organisations at once, looking for anyone with an easy weakness rather than targeting you specifically.
- Shared responsibility modelA shared responsibility model is a cloud provider's written explanation of which security tasks it handles and which ones remain the customer's job.
- Signature-based detectionSignature-based detection is the way anti-malware software recognises known malware, by comparing files against a list of fingerprints, called signatures or definitions, supplied by the vendor.
- Social engineeringSocial engineering is manipulating people, rather than hacking computers, to get them to hand over information, money or access, usually by pretending to be someone they trust.
Frequently asked questions
A security operations centre (SOC) is a team, in-house or outsourced, that watches an organisation's systems for signs of attack and responds when something suspicious happens.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.