---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose
The purpose of this policy is to prevent the unintentional exposure of sensitive company data to unlicensed third-party tools or the public. This includes, but is not limited to, situations where the Security Operations Center (SOC), during the course of an investigation, submits evidence to external tools or websites (e.g., cyberchef, urlscan.io , VirusTotal) that may result in a data privacy breach. The policy ensures the SOC adheres to strict guidelines for using only approved, licensed tools and protects the company from unauthorized data disclosure.

## Scope
This policy applies to all Security Operations Center (SOC) personnel, contractors, and any individuals performing investigative or analytical tasks on behalf of the SOC. It covers all tools, platforms, and services used for investigation, analysis, or evidence submission and pertains to any data generated, handled, or submitted during SOC operations.
## Roles and Responsibilities

| Role        | Responsibility                                                                                                                                                                                                                                                                                                                                                  |
| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SOC Analyst | Use only licensed and approved tools for investigative and analytical purposes.Verify the scope and permissions of tools before submitting any company data.Document and seek approval before utilizing any unlicensed or unapproved tools.Immediately report suspected or actual data exposure incidents to the SOC Manager.                       |
| SOC Manager | Maintain an updated list of licensed and approved tools for SOC operations.Provide guidance and training on the proper use of tools and data handling.Review and approve requests for the use of unlicensed tools, documenting the justification and associated risks.Investigate and mitigate any incidents involving unintentional data exposure. |

## Policy Statement
SOC personnel are strictly prohibited from submitting any company data, including investigative evidence, to unlicensed or unapproved third-party tools or websites.

The following rules apply:

- **Licensed Tools Only**: Only use tools that are expressly approved and licensed by the company.
- **Documentation and Approval**: Any use of unlicensed or unapproved tools must be documented, and prior approval must be obtained from the SOC Manager.
- **Sensitive Data Handling**: All sensitive company data must be anonymized or redacted before submission, even when using licensed tools, unless submission of unaltered data is explicitly required and approved.

SOC personnel must ensure due diligence to evaluate the data handling and privacy policies of third-party tools before use.
### Policy Elements

#### 1.  Approved Tools List
1. SOC operations must reference and adhere to the company-maintained list of licensed and approved tools.
2. Updates to the list must be communicated promptly to SOC personnel.
#### 2. Pre-Submission Assessment
1. Prior to submitting evidence to any tool, SOC personnel must confirm:
	1. The tool’s license status.
	2. Whether sensitive company data is included.
	3. Whether the data is anonymized or redacted, where feasible.
#### 3. Use of Unlicensed Tools
1. Use of unlicensed tools is only permissible with prior documentation and written approval from the SOC Manager.
2. The documentation must include:
	1. The name and purpose of the tool.
	2. A description of the data to be submitted.
	3. A risk assessment outlining potential exposure risks.
#### 4. Incident Reporting and Response
1. Any suspected or actual exposure of sensitive company data must be reported to the SOC Manager immediately.
    1. The SOC Manager will:
        1. Investigate the incident.
        2. Coordinate with relevant teams to contain and mitigate risks.
        3. Document the incident for further analysis and prevention.
        4. Develop a mitigation plan and track implementation to prevent future incidents.

## Enforcement and Compliance
Non-compliance with this policy may result in disciplinary action, up to and including termination of employment or contract. SOC personnel who violate this policy may lose tool access privileges and may be subject to additional oversight. Repeated violations will prompt a review of access permissions and operational procedures.

## Policy Review
This policy will be reviewed annually by all employees to ensure its continued relevance and effectiveness. Feedback and suggestions for improvement are welcome and should be directed to the SOC Leadership.

Effective Date:

|Last Reviewed By     | Date    |
| --- | --- |
|     |     |
