---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose
This policy establishes guidelines for contacting the Security Operations Center (SOC) and ensuring continuous availability for cybersecurity incident reporting and inquiries. Open communication channels are critical for early threat detection, rapid response, and organizational security.

The SOC must maintain accessible communication inputs for employees, ensuring timely reporting and response to cybersecurity concerns. This includes maintaining:

- A dedicated hotline (ideally a toll-free, international number) with a call tree to reach an available SOC Analyst 24/7.
- A shared SOC email mailbox, monitored during active shifts, with integration into the organizational ticketing system for efficient tracking and response.

End users serve as critical early warning sensors, and every effort should be made to advertise how and when to contact the SOC.
## Scope
This policy applies to:

- All SOC personnel (SOC Analysts, SOC Managers, and SOC Leadership).
- All employees, contractors, and business units who may need to contact the SOC to report cybersecurity concerns.
- Organizational IT and security teams that interact with the SOC for incident management and response.

This policy governs:

- Communication channels used to report cybersecurity concerns.
- Procedures for monitoring and responding to inbound communications.
- Tracking and documentation of all reports.
- Service Level Targets (SLTs) for response and follow-up.
## Roles and Responsibilities

| Role         | Responsibility                                                                                                                                |
| ------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
| SOC Analyst  | Monitors and responds to inbound requests via the hotline and shared email mailbox. Logs all communications in the incident ticketing system. |
| SOC Manager  | Ensures SOC Analysts adhere to response timelines, tracks reporting metrics, and verifies communication channel functionality.                |
| SOC Director | Oversees communication policy implementation, validates SLT compliance, and reviews reporting trends.                                         |
| End Users    | Report cybersecurity concerns via the hotline or SOC email mailbox. Provide relevant information to assist in investigations.                 |


## Policy Statement
The SOC must maintain 24/7 availability to respond to cybersecurity concerns, ensuring that employees can report incidents efficiently and securely.

To achieve this, the SOC will:

1. Maintain open communication channels for security reporting via hotline and email.
2. Ensure all inbound requests are logged in the incident ticketing system for tracking and follow-up.
3. Set clear Service Level Targets (SLTs) for acknowledgment, response, and follow-up.
4. Track and analyze report trends and outcomes to improve security awareness and response effectiveness.
5. Routinely validate the functionality of all SOC communication channels.
### Policy Elements
### 1. SOC Communication Channels

The following communication channels must be maintained:

1. SOC Hotline (24/7 Call Tree)
    - A toll-free, international number must be available for reporting cybersecurity concerns.
    - The hotline must follow a call tree structure, ensuring a SOC Analyst is reachable at any time of day or night.
    - The SOC Analyst on shift must document all hotline calls in the incident ticketing system.
2. Shared SOC Email Mailbox
    - The SOC must maintain a shared email mailbox that all SOC members can access.
    - SOC Analysts on shift must actively monitor the mailbox for new reports.
    - Inbound emails must be automatically logged as tickets in the incident tracking system, with each ticket assigned to the SOC queue for monitoring.

### 2. Logging and Tracking of Inbound Reports

- All phone and email reports must be documented in the incident ticketing system for tracking, handoff, and follow-up.
- Each report must include:
    - Date and time of report.
    - Name and contact information of the reporter.
    - Summary of the cybersecurity concern.
    - Actions taken and ticket status.
- SOC Analysts must update tickets with investigation details and resolution steps to ensure continuity across shifts.

### 3. Service Level Targets (SLTs) for Response

To ensure timely handling of inbound reports, the following SLTs are established:

|Action|Target|
|---|---|
|Acknowledgment of email or phone report|Within 15 minutes of receipt|
|Initial investigation and triage|Within 1 hour|
|First follow-up update to the reporter|Within 4 hours|
|Resolution or escalation to Incident Response|Based on severity, within 24-72 hours|

### 4. Advertisement and Awareness

- The SOC must actively promote communication channels so employees know how to report cybersecurity issues.
- Awareness efforts include:
    - Posting contact details on the company intranet, security awareness materials, and onboarding documentation.
    - Conducting periodic training to educate employees on when and how to contact the SOC.

### 5. Monitoring and Validating Communication Channels

- The SOC must routinely test the hotline and shared mailbox to verify proper functionality.
- Tests can be conducted manually or through automated alerting tools on a set schedule (e.g., weekly or monthly).
- SOC Leadership must track:
    - Volume of reports (phone/email).
    - Response time adherence to SLTs.
    - Report outcomes (true positive, false positive, misreport, etc.).

## Enforcement and Compliance
- All SOC personnel are responsible for adhering to this policy and ensuring timely responses to cybersecurity concerns.
- Failure to monitor communication channels or log reports in the incident tracking system may result in corrective actions as defined by SOC leadership.
- The SOC Director is responsible for ensuring compliance with this policy and conducting periodic reviews of response performance.
- Any modifications to this policy must be approved by the SOC Director and organizational leadership.

## Policy Review
This policy will be reviewed annually by all employees to ensure its continued relevance and effectiveness. Feedback and suggestions for improvement are welcome and should be directed to the SOC Leadership.

Effective Date:

|Last Reviewed By     | Date    |
| --- | --- |
|     |     |
