---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose
The purpose of this policy is to establish a structured approach for tracking, reporting, and reviewing Security Operations Center (SOC) performance and impact metrics. By collecting and analyzing key metrics, the SOC can measure effectiveness, support operational improvements, and provide meaningful insights to leadership. Metrics will be used to demonstrate SOC value without incentivizing rushed investigations, ensuring a continued focus on quality and thoroughness.
## Scope
This policy applies to all SOC personnel, including SOC Analysts, Shift Leads, SOC Leadership, and the SOC Director. It governs the collection, reporting, and utilization of SOC metrics at weekly, monthly, and quarterly intervals.
## Roles and Responsibilities

| Role                     | Responsibility                                                                                                                                                                                         |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| SOC Analyst              | Accurately document work efforts and investigation details.Contribute to runbook development and process improvements.Provide input on quality assurance efforts.                              |
| Shift Lead               | Review analyst performance metrics for quality and completeness.Ensure the accuracy of reported metrics.Highlight notable cases and quality assurance findings.                                |
| SOC Manager              | Review weekly, monthly, and quarterly SOC metrics.Utilize metrics for operational planning and performance assessment.Present SOC performance data during the Quarterly Business Review (QBR). |
| Cybersecurity Leadership | Evaluate SOC metrics in the context of broader cybersecurity strategy.Provide feedback on SOC effectiveness and areas for improvement.                                                             |

## Policy Statement
The SOC must track and report key performance and impact metrics to measure effectiveness, identify areas for improvement, and highlight significant trends. Metrics should be designed to support quality, accuracy, and operational transparency while avoiding incentives that prioritize speed over thorough investigations.
### Policy Elements
#### 1. SOC Metric Collection and Reporting

- **Weekly Reports:**
    - Number of alerts processed.
    - Number of tickets handled.
    - Number of investigations completed.
    - Average time to close alerts.
    - Average time to investigate security incidents.
    - Average time waiting on other teams.
    - Notable cases for review.
    - Quality assurance and review findings.
    - Team changes, ongoing projects, and timelines.
    - Any significant threat hunts or intelligence findings.
- **Monthly Roll-Up:**
    - Aggregated trends from weekly reports.
    - Number of new runbooks and documentation produced.
    - Number of documentation reviews and updates completed.
    - Number of process improvements implemented.
    - Number of detections monitored.
    - Number of new detections deployed.
    - Number of detections planned for engineering.
- **Quarterly Business Review (QBR):**
    - Key trends and long-term performance analysis.
    - Significant security incidents and lessons learned.
    - SOC improvements and operational changes.
    - Future roadmap for SOC enhancements and strategic initiatives.

#### 2. Ensuring Metrics Support Quality Work

- SOC metrics should be structured to reflect thoroughness and effectiveness, not speed.
- Analysts must be encouraged to focus on the quality of investigations rather than prioritizing rapid closures.
- Quality assurance reviews must be integrated into the weekly reports to provide oversight and ensure accurate reporting.

#### 3. Continuous Improvement Through Metrics

- SOC Leadership must use collected metrics to assess operational gaps and propose improvements.
    - Each month, the SOC Manager should analyze the metrics and propose enhancement and improvement strategies to strengthen the security posture.
    - Proposals should include metrics of success to measure posture improvement.
    - Proposals will be reviewed and approved by the SOC Director.
    - SOC Director is responsible for ensuring implementation and project success for improvements.
- Metrics should inform decisions on tool investments, staffing, and training needs.
- Runbook and process documentation updates must be tracked to ensure continuous refinement of SOC operations.

## Enforcement and Compliance
This policy ensures that SOC operations are measurable, transparent, and continually improving while maintaining a focus on high-quality investigations and operational excellence. Non-compliance hampers the company’s ability to demonstrate value from investment in SOC and could result in risk to current funding and investment.

## Policy Review
This policy will be reviewed annually by all employees to ensure its continued relevance and effectiveness. Feedback and suggestions for improvement are welcome and should be directed to the SOC Leadership.

Effective Date:

|Last Reviewed By     | Date    |
| --- | --- |
|     |     |
