---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose
The purpose of this policy is to establish a structured and effective shift handoff process within the Security Operations Center (SOC). The shift handoff period is a critical time when changes introduce risk, and ensuring a smooth transition is essential for maintaining cybersecurity readiness and operational continuity. This policy enforces consistent procedures to mitigate risk and ensure proper communication between shifts.

## Scope
This policy applies to all SOC personnel, including analysts, engineers, and leadership, who participate in shift handoffs. It covers the processes and responsibilities related to:

- Shift transition and continuity of operations
- Communication of changes, ongoing investigations, and critical alerts
- Proper documentation and assignment of ongoing investigations
- Identification of oncoming Shift Lead and Senior Analysts
- Immediate risk reporting in case of coverage gaps

All SOC team members must adhere to this policy to ensure seamless shift transitions and minimize operational risk.

## Related Content
* [[POL - 24x7 Scheduling]]

## Roles and Responsibilities

| Role                  | Responsibility                                                                                                                                                                                                                                                                                                                                                         |
| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Departing SOC Analyst | - Provide a detailed verbal review of major events and changes during the shift. - Communicate all ongoing investigations and assign each to an incoming SOC Analyst with explicit verbal acknowledgment.- Document key updates in the designated system for later review.- Ensure the oncoming Shift Lead and Senior Analysts are identified and briefed. |
| Arriving SOC Analyst  | - Actively listen and ask questions to clarify information during the handoff.- Verbally acknowledge and accept assigned investigations and tasks. - Review notes and documentation to ensure situational awareness.- Arrive on shift on time or provide advance notice and a coverage plan if unable to do so.                                            |
| Arriving Shift Lead   | - Ensure all investigations and workstreams are properly reassigned.- Identify the Senior Analysts available during the shift.- If a coverage gap is identified, notify a SOC Manager immediately and report the risk.                                                                                                                                         |
| SOC Manager           | - Address any reported coverage gaps and determine mitigation actions.- Monitor compliance with the shift handoff policy and enforce accountability.                                                                                                                                                                                                               |
## **Policy Statement**

Shift handoff is a structured process designed to ensure seamless operational continuity and reduce security risks. Each shift handoff must include a **30-minute overlap** between the departing and incoming shifts to allow for thorough discussion and follow-up.

During the shift handoff, the departing team must provide a **verbal review** of significant incidents, changes, and ongoing investigations. Each open investigation must be explicitly reassigned to a named member of the oncoming shift with verbal confirmation of acceptance. Shift handoff notes must be documented in the designated system for later reference.

Oncoming analysts must arrive on shift **on time** or provide prior notice along with a coverage plan. The oncoming Shift Lead is responsible for ensuring that all investigations and tasks are reassigned and that any **coverage gaps** are escalated to a SOC Manager immediately.
### **Policy Elements**

#### **1. Shift Overlap Requirement**

- A minimum **30-minute overlap** between shifts is required to facilitate a smooth transition.
- This overlap allows time for discussion, questions, and necessary follow-ups.

#### **2. Verbal Handoff and Assignment of Investigations**

- The departing shift must provide a **verbal review** of:
    - Major security incidents and ongoing investigations
    - System updates and configuration changes
    - Any operational changes that impact security monitoring
- All open investigations must be reassigned to an oncoming analyst, who must verbally acknowledge acceptance.

#### **3. Identification of Shift Lead and Senior Analysts**

- The oncoming shift must identify the Shift Lead and Senior Analysts who will be available for guidance.
- The Shift Lead is responsible for managing assignments and addressing coverage concerns.

#### **4. Documentation and Record Keeping**

- Shift handoff notes must be recorded in the designated system.
- The system should be accessible for reference and audit purposes.
- Documentation must include:
    - Summary of major incidents
    - Reassigned investigations and their new owners
    - Any noted issues or follow-ups required
    - List of shift handoff attendees including departing and oncoming shifts.

#### **5. Escalation of Coverage Gaps**

- If a coverage gap is identified during shift handoff, the oncoming Shift Lead must immediately notify a SOC Manager.
- The SOC Manager is responsible for mitigating the risk and ensuring continuity of operations.

#### **6. Analyst Attendance and Shift Responsibility**

- SOC Analysts must arrive on shift **on time** to ensure seamless coverage.
- If an analyst is unable to attend their shift, they must notify the Shift Lead in advance and arrange coverage.
- Repeated failures to provide coverage or timely notification may result in disciplinary action.
