Chapter 17 — Continuous monitoring and SOC maturity
Lesson map
Lesson 17 published. Map, example, EX065.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Continuous monitoring"]
N2["17.2 SOC-CMM"]
N3["17.3 Northgate's assessment"]
N4["17.4 Improvement plan"]
N5["17.5 Governance"]
N6["17.6 Research"]
N7["Measuring progress"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX065"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Continuous monitoring"]
N2["17.2 SOC-CMM"]
N3["17.3 Northgate's assessment"]
N4["17.4 Improvement plan"]
N5["17.5 Governance"]
N6["17.6 Research"]
N7["Measuring progress"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX065"]
[Learning outcomes]
|
v
[17.1 Continuous monitoring]
|
v
[17.2 SOC-CMM]
|
v
[17.3 Northgate's assessment]
|
v
[17.4 Improvement plan]
|
v
[17.5 Governance]
|
v
[17.6 Research]
|
v
[Measuring progress]
|
v
[Worked example] --> [Exercise EX065]
Learning outcomes
You will (1) explain continuous monitoring per SP 800-137; (2) assess SOC maturity with SOC-CMM; (3) plan improvements; (4) report to governance.
17.1 Continuous monitoring
NIST SP 800-137 (Dempsey et al., 2011) describes information security continuous monitoring: ongoing awareness of security, vulnerabilities and threats to support risk decisions. For Northgate, continuous monitoring means knowing at any time which servers send logs, which rules are tested and which threats are rising. The risk committee uses this to decide what to fund. The 18 servers not sending logs are exactly the kind of gap it is meant to reveal. Continuous monitoring covers the SOC's own tools as well as the council's systems. Gaps in either, such as silent agents or servers without logs, are reported to the risk committee.
17.2 SOC-CMM
The SOC Capability Maturity Model (van Os, 2016) assesses business, people, process, technology and services domains. Northgate uses the model to see where it is strong and weak across all five domains, not only technology. An honest score in each domain gives a baseline that the next assessment, a year later and using the same method, can be compared against fairly. The five domains deliberately cover much more than the SOC's technology alone. Northgate's assessment is scored from evidence such as logs and records, not from opinion. Carlos's part was collecting evidence for the technology domain, which is how he found the 18 silent servers.
17.3 Northgate's assessment
Strong on process documentation, weak on technology coverage and people development. The assessment's findings match what the earlier chapters of this book have shown. Playbooks and procedures were written down, but 18 servers sent no logs and the coverage map showed gaps such as cloud storage. People development was weak, with no training budget per analyst before the plan. The assessment's evidence is kept so the next one can check whether each weakness improved. Results were shared with the whole team, not only managers.
17.4 Improvement plan
Three items: log coverage to 95% of servers, training budget per analyst, quarterly rule reviews. Each item addresses a weak area: log coverage for technology, training budget for people, and rule reviews to keep detections tested. The 95% target follows from the 18 servers found missing, 15 of which IT fixed within a month. Each item has a named owner and a measure reported to the risk committee. Progress on all three items is reported to the council's risk committee each quarter. Any item that slips behind its date is explained in a short note beside the table.
17.5 Governance
Results go to the council's risk committee each quarter, tying SOC work to CSF 2.0 Govern. Reporting to the risk committee puts SOC gaps alongside other council risks, so spending can be compared. It also makes the SOC accountable for progress on its plan. Linking to Govern shows the SOC's work as part of how the council manages risk. The committee can ask for more detail on any item. The committee also approves the training budget that the people-development item depends on.
17.6 Research
Vielberth et al. (2020) surveyed SOCs and found people, process and technology must be balanced. Northgate's assessment shows the same lesson: strong process documentation could not make up for weak technology coverage and people development. The improvement plan balances all three with one item each. A SOC with excellent tools but untrained staff would still miss cases like parks01. The paper supports Aisha's choice to spread the plan across all three areas. Northgate's improvement plan accordingly has one item for each of the three areas.
Measuring progress
Each improvement item has a measure and a date. Log coverage is measured weekly from the SIEM's list of reporting servers; training is measured by courses completed; rule reviews by the number reviewed per quarter. Progress is shown to the risk committee as a simple table of target, current value and trend, with a short note on any item that slipped and why.
Assessment honesty
Maturity scores are only useful if honest. Aisha insists the team rate what is actually done, not what is written in documents. A process that exists on paper but is not followed scores low. The first honest assessment looked worse than expected, but it gave a clear baseline; the following year's assessment showed real progress that the risk committee could trust because the starting point had not been inflated.
Next assessment
The next SOC-CMM assessment is booked a year later, using the same scoring method so results compare fairly.
Worked example
Carlos helps collect evidence for the SOC-CMM technology domain and finds 18 servers not sending logs; IT fixes 15 within a month.
Synthetic case. Scores are invented.
Errors and limits
Maturity models describe capability, not effectiveness against real attacks.
Exercises
- EX065 — SP 800-137 aim. What does continuous monitoring support? Rubric: 3 = risk decisions with ongoing awareness; 2 = partial; 1 = vague; 0 = none.
- EX066 — SOC-CMM domains. Name the five SOC-CMM domains. Rubric: 3 = business, people, process, technology, services; 2 = four; 1 = two; 0 = none.
- EX067 — Weak areas. Where was Northgate weak? Rubric: 3 = technology coverage, people development; 2 = one; 1 = vague; 0 = none.
- EX068 — Log gap. How many servers lacked logs and how many were fixed? Rubric: 3 = 18; 15; 2 = one; 1 = vague; 0 = none.
Synthesis
Monitoring continuously and assessing maturity guide steady improvement.
Continue studying — chapter 17 of 18
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →