Chapter 7 — Security operations and blue team: organizational integration
Lesson map
Lesson 07 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["7.1 The SOC in the organisation"]
N2["7.2 Service levels"]
N3["7.3 Escalation paths"]
N4["7.4 Risk reporting"]
N5["7.5 Hybrid model integration"]
N6["7.6 Change management"]
N7["7.7 Relationships"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 The SOC in the organisation"]
N2["7.2 Service levels"]
N3["7.3 Escalation paths"]
N4["7.4 Risk reporting"]
N5["7.5 Hybrid model integration"]
N6["7.6 Change management"]
N7["7.7 Relationships"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]
[Learning outcomes]
|
v
[7.1 The SOC in the organisation]
|
v
[7.2 Service levels]
|
v
[7.3 Escalation paths]
|
v
[7.4 Risk reporting]
|
v
[7.5 Hybrid model integration]
|
v
[7.6 Change management]
|
v
[7.7 Relationships]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) integrate the SOC with business units, IT, legal and HR; (2) define service levels and escalation paths; (3) align SOC work with enterprise risk management; (4) manage change across teams.
7.1 The SOC in the organisation
NIST CSF 2.0's Govern function places cybersecurity within enterprise risk management. The SOC is one part: it detects and responds, but depends on business units for context and on IT for action. At Meridian, the SOC's place under Govern means that its risk reports go to the enterprise risk committee, not only to IT. The claims operations manager supplies context on assignment and workload; IT performs account actions; legal and the data protection officer decide on notification. The SOC coordinates these but owns only detection and investigation, which is why escalation paths matter as much as tools.
7.2 Service levels
Daniel's service catalogue sets levels: P1 alerts acknowledged in 15 minutes, investigations started within 4 hours, monthly reports to each business unit. These levels came from the service catalogue Daniel drafted after comparing Meridian with forum peers. They also give the board measurable targets: the 15-minute P1 acknowledgement is the indicator that dipped in March and later recovered under the hybrid night model. Each level names who measures it and where it is reported. Each level is reported monthly to the business unit it serves, with misses explained.
7.3 Escalation paths
For claims-system alerts, escalation goes to the claims operations manager for business context, to IT for account actions, to legal and the DPO for possible breaches, and to HR only when misconduct is suspected after review. The order protects staff: HR is involved only after review suggests misconduct, as with flags like h04's that turned out to be project work. In the partner case, escalation reached legal and the data protection officer early because health data might have been copied. The escalation runbook names a person and a deputy for each path, so nobody has to search for contacts at night.
7.4 Risk reporting
The SOC reports risks in business terms to the enterprise risk committee: likelihood and impact of data disclosure, trends and treatment actions. For the contractor-account weakness, Daniel's report to the committee described the likelihood of a repeat, the possible disclosure of health data, and the treatment: the contractor directory, the confirmation request and the rule allowing immediate suspension of export rights. The committee tracks that treatment until the applied project reports its results, alongside other enterprise risks of similar size.
7.5 Hybrid model integration
With the managed night service, integration includes data access agreements, an escalation runbook and a shared case system. The provider's first night P1, a burst of failed logins to the claims portal, tested this integration. The runbook routed it to the on-call engineer, but the provider's note lacked the source network, so Daniel added that field to the escalation template. The shared case system meant both teams saw the same record, and the provider's quality was reviewed against the escalation precision target the board had set.
7.6 Change management
New monitoring or response capabilities are introduced with communication to affected teams, training and feedback. When the automated suspension of contractor export rights was introduced, Daniel briefed procurement and contractor managers first, explaining that suspension covers only exports and is reviewed within four hours. Analysts were trained on the review step, and contractors' feedback after the first suspensions informed small changes. Introducing it silently would have made the first wrongful suspension look like an attack on contractors. Before launch, analysts practised the four-hour review step on test scenarios built from past claims-export alerts.
7.7 Relationships
Daniel meets each business unit lead quarterly; regular contact makes incident calls smoother. These meetings paid off in the partner case: the claims operations manager already knew Daniel and could confirm within hours which weekend work had been approved. Without that relationship, the SOC would have waited for formal requests to move through several teams. Each meeting also lets business leads raise concerns about monitoring before they turn into complaints, which keeps insider-risk work acceptable to staff. Notes from each meeting record open requests and owners, so a business lead's concern about monitoring is followed up at the next one.
Measuring integration
Daniel tracks how often escalations reach the right team first time. Early in the hybrid model, 70% did; after runbook updates, 92% did.
Worked example
When the managed provider escalates its first night P1 — a burst of failed logins to the claims portal — the runbook directs it to the on-call engineer, who decides no action is needed. The escalation took 11 minutes; the provider's note lacked the source network, so Daniel updates the runbook template.
Synthetic case. Arrangements and events are invented.
Errors and limits
Integration depends on people; turnover can break paths that look fine on paper.
Exercises
- EX031 — Govern link. How does CSF 2.0 Govern relate to the SOC? Rubric: 3 = places SOC within enterprise risk management; 2 = partial; 1 = vague; 0 = none.
- EX032 — Escalation routes. List the escalation routes for claims alerts. Rubric: 3 = claims ops, IT, legal/DPO, HR only after review; 2 = three; 1 = one; 0 = none.
- EX033 — Risk language. How does the SOC report to the risk committee? Rubric: 3 = business terms: likelihood, impact, trends, treatments; 2 = partial; 1 = technical; 0 = none.
- EX034 — First escalation. What did the first night escalation reveal? Rubric: 3 = note lacked source network; template updated; 2 = partial; 1 = vague; 0 = none.
- EX035 — Quarterly meetings. Why meet business leads quarterly? Rubric: 3 = relationships make incident calls smoother; 2 = partial; 1 = reporting only; 0 = none.
Synthesis
Integrate the SOC through service levels, escalation paths, risk reporting and steady relationships.
Continue studying — chapter 07 of 12
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →