1.8 SOC Maturity Assessment
SOC Maturity Assessment
Introduction
A maturity assessment tells you where you are, where you should be, and what to do to get there. It converts the abstract question “how good is our SOC?” into a structured evaluation across defined capability areas with specific improvement actions for each gap.
The five-level maturity model
Each SOC capability is assessed on a five-level scale:
| Level | Name | Description |
|---|---|---|
| 1 | Initial | The capability exists in ad hoc form. No documented process. Success depends on individual effort. |
| 2 | Repeatable | A defined process exists and is followed by most team members most of the time. Documentation exists but may be incomplete. |
| 3 | Defined | The process is documented, standardized, and consistently followed. Metrics are collected. Quality is measured. |
| 4 | Managed | Metrics drive continuous improvement. Process changes are based on data, not intuition. Performance is predictable. |
| 5 | Optimising | The capability is continuously improved through systematic innovation. Best practices are identified, tested, and adopted. Industry-leading performance. |
Most SOC teams operate between levels 1 and 3 across their capabilities. Level 5 is rare and not necessary for effective security operations. The practical target for most organizations is level 3 (Defined) across all core capabilities and level 4 (Managed) for the most critical ones.
Assessment domains
Assess each domain independently — a SOC can be level 3 in detection and level 1 in documentation:
| Domain | Level 1 indicators | Level 3 indicators | Level 4 indicators |
|---|---|---|---|
| Detection | Vendor default rules only, no custom detections | Custom rules deployed with specifications, ATT&CK coverage tracked, FP rates measured | Detection backlog managed in sprints, rule quality metrics drive tuning, coverage gaps systematically closed |
| Investigation | Ad hoc investigation, no playbooks, quality varies by analyst | Playbooks exist for major incident types, followed consistently, investigation log maintained | Playbooks updated from every PIR, investigation quality measured across analysts, consistent outcomes regardless of who investigates |
| Containment | Analyst decides containment ad hoc, no documented authority | Containment framework with blast radius documentation, approval matrix in charter | Containment verified systematically, persistence checklist completed for every confirmed compromise |
| Documentation | Incidents closed with one-line comments | Incident records follow template, executive summaries produced, evidence collected with hashes | Real-time investigation logging standard practice, regulatory assessments documented, PIR actions tracked to completion |
| Metrics | No metrics collected | Core metrics measured monthly (MTTD, MTTR, SNR, SLA compliance) | Metrics drive resource allocation and process changes, trend analysis identifies systemic issues |
| Communication | Ad hoc notification by whoever is available | Notification templates exist, escalation matrix followed, stakeholder communication documented | Communication effectiveness measured (were stakeholders satisfied?), templates refined from feedback |
| People | Single analyst handles everything, no defined tiers | Tiers defined, responsibilities clear, training program exists | Career development pathway, cross-training reduces single points of failure, analysts progress through tiers based on demonstrated skill |
| Tooling | Sentinel deployed with defaults, minimal customization | Tools configured for the environment, integrations between platforms, automation for enrichment | Tool stack optimized, automation for low-risk containment, custom integrations for the organization’s specific workflow |
Running the assessment
Step 1: For each domain, identify which level description most accurately matches your current state. Be honest — overestimating maturity produces a roadmap that misses critical gaps.
Step 2: For each domain, identify the target level. Not every domain needs to reach level 4. Choose targets based on the risk areas that matter most to your organization.
Step 3: For each domain where current < target, identify the specific actions needed to reach the next level. Do not try to jump from level 1 to level 4 — progress one level at a time.
Step 4: Prioritize the improvement actions. Detection and investigation improvements (catching threats) typically have higher impact than documentation and metrics improvements (measuring the catching). But documentation improvements are often lower effort and build the foundation for measuring everything else.
Maturity assessment scorecard
SOC MATURITY SCORECARD
======================================================
Organization: [Name]
Assessment date: [Date]
Assessed by: [Name]
Domain | Current | Target | Gap | Priority
Detection | 2 | 3 | 1 | High
Investigation | 2 | 3 | 1 | High
Containment | 1 | 3 | 2 | Critical
Documentation | 1 | 3 | 2 | High
Metrics | 1 | 3 | 2 | Medium
Communication | 2 | 3 | 1 | Medium
People | 2 | 3 | 1 | Medium
Tooling | 2 | 3 | 1 | Low
Top 3 improvement priorities:
1. Containment framework (Level 1→3): Deploy
containment decision framework + authority matrix
from Module S7/Charter
2. Documentation (Level 1→3): Implement incident
record template + investigation log from Module S8
3. Detection (Level 2→3): Deploy detection rule
specifications for all active rules from Module S2
Review schedule: Quarterly
======================================================
The scorecard is a one-page snapshot. Review it quarterly. The quarterly comparison shows movement: “Containment moved from 1 to 2 after we deployed the containment framework. Detection moved from 2 to 3 after we added specifications to all 14 rules.” This trend is the evidence of SOC improvement that the CISO presents to the board.
Try it yourself
Complete the maturity scorecard for your SOC. For each domain, identify the current level using the indicators table. Be specific about the evidence: "We have 3 custom detection rules, but none have specifications or documented FP profiles" = Level 2 for Detection (rules exist but are not fully documented). Then identify your top 3 improvement priorities and the specific action for each.
Check your understanding
1. Your maturity assessment shows Detection at Level 3 but Documentation at Level 1. Why is this combination problematic even though detection is strong?
You're reading the free modules of SOC Operations
The full course continues with advanced topics, production detection rules, worked investigation scenarios, and deployable artifacts. Premium subscribers get access to all courses.