Choosing SOC maturity levels

Assessments & Maturity
1

A common reason for performing SOC capability majority assessments is determining strength and weaknesses, and using the insight to improve security operations. But going from assessment outcomes to actual maturity improvement can prove to be challenging. Many SOCs experience limitations, mostly time, resources, and budget.

Any maturity improvement requires investment. It takes time, resources, and money to get to a higher level of maturity. It also takes time, resources, and money to operate at a higher level of maturity. So, an essential part of maturity improvement, is getting commitment for that improvement at the right (senior) management level. Getting that commitment requires understanding maturity objectives.

Thus, it is vital to determine what the appropriate maturity level is for the SOC. This should be the starting point for any maturity journey. What factors do you consider when choosing the appropriate maturity level for your SOC?

1 Like
2

I’ve created a table today that could be helpful in selecting maturity levels. Instead of providing extensive definitions for each level, I have chosen to use keywords. And added a few parameters:

  • 3 parameters with positive maturity effects: risk reduction, reliability, transparency/demonstrability
  • 2 parameters with negative matuirty effects: overhead, operational cost

Here is the table:

# Level Keywords Residual risk Reliability Transparency / demonstrability Overhead Operational cost
0 Non-existent non-existent Very high None None None None
1 Initial ad-hoc High Low None Low Very low
2 Managed semi-structured, inconsistent Medium Medium Low Low Low
3 Defined documented, structured, consistent, reliable, repeatable Low High Medium Medium Medium
4 Quantitatively managed measured, quality-assured Low Very high High High High
5 Optimizing rigorously controlled, continuously improved & optimised Very low Very high Very high Very high Very high

I’m looking for your insights here:

  • Are these the right parameters to demonstrate differences between maturity levels?
  • Are the indicates from (very) low to (very) high correctly assigned?
  • And most importantly: will this table help to make more informed decisions about SOC maturity levels?

Let me know in the comments!

1 Like
3

Hey @robvanos, thanks for sharing this insight, but I have a question. When you say “selecting maturity levels” is it about the target maturity level, that the company disaier?

4

Correct, it is about the target maturity level for the SOC.

What is important to realise is that target maturity levels can be set in 2 ways:

  1. As a target for the current state. In this case, you decide at which level the SOC should be operating at the moment and then conduct an assessment to see if it matches the expectations. This makes the assessment more of an validation assessment.
  2. As a target for a future state. In this case, you decide at which level the SOC should ultimately operate. Using the current state, you can determine the gap and create a roadmap to the desired maturity state.

It is up to the organisation under assessment to determine which of these approaches makes most sense.

1 Like
5

@robvanos Thank you! I’m going to use your suggestions.

What is the benchmark for Maturity and Capability