---
title: "Policy Statement"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

Purpose
The purpose of this policy is to establish the responsibilities and expectations for Level 3 (L3) Security Operations Center (SOC) analysts. L3 analysts are senior SOC analysts on shift, responsible for providing expertise, oversight, support, and training for all SOC analysts. This policy ensures that at least one L3 analyst is available at all times to maintain the efficiency and effectiveness of SOC operations.

Scope
This policy applies to all SOC personnel, including L3 analysts, SOC analysts, SOC Shift Leads, and the SOC Director. It governs L3 availability, oversight, and mentorship responsibilities within SOC operations.

Roles and Responsibilities

| Role         | Responsibility                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| ------------ |   |
| L3 Analyst   | - Provide expertise and oversight for all SOC analysts on shift.- Ensure at least one L3 is available at all times to support SOC operations.- Review SOC findings of true positives before escalation to the IR team.- Review analyst case closures and notes to identify areas for improvement and training.- Offer mentorship and hands-on training to junior analysts.- Be available for guidance and shadowing sessions for SOC analysts unsure of investigative steps.- Serve as Shift Leads when assigned.- Ensure the quality and accuracy of all SOC analyst work.- Be available to support the SOC Director or answer questions from the SOC Director regarding investigations. |
| SOC Analyst  | - Escalate all potential true positives to an L3 analyst for review.- Seek guidance from L3 analysts when needed during investigations.- Apply feedback and training provided by L3 analysts to improve investigative processes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Shift Lead   | - Ensure that at least one L3 analyst is assigned and available at all times.- Coordinate with L3 analysts to improve team proficiency and effectiveness.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| SOC Managers | - Ensure adherence to this policy and oversee L3 performance.- Seek input from L3 analysts on complex investigations and SOC operational improvements.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
## Policy Statement

The SOC must have at least one L3 analyst available at all times to provide expertise, oversight, and support to SOC analysts. L3 analysts play a critical role in ensuring investigations meet high-quality standards before escalation and in mentoring junior analysts to improve SOC capabilities.

### Policy Elements

#### 1. L3 Availability

- At least one L3 analyst must be available at all times during SOC operations.
- L3 analysts must be accessible for immediate consultation and support.
- In the absence of an assigned L3, a designated backup must be identified.

#### 2. Oversight and Responsibility

- L3 analysts must review all SOC findings of true positives before escalation.
- L3 analysts must review analyst case closures and notes to identify areas for improvement.
- L3 analysts must ensure that investigations are properly documented and adhere to SOC processes.

#### 3. Training and Mentorship

- L3 analysts are responsible for mentoring junior SOC analysts and providing training opportunities.
- L3 analysts should facilitate shadowing sessions to guide analysts through investigations.
- Training should focus on improving investigative techniques, analytical skills, and adherence to SOC processes.

#### 4. Communications and Support

- L3 analysts must be available to answer any questions from the SOC Director and IR team regarding investigations.
- L3 analysts must provide clear, documented feedback to SOC analysts to enhance learning and professional development.
- L3 analysts may serve as Shift Leads and take on additional leadership responsibilities as required.

## Compliance and Enforcement

By implementing this policy, the SOC ensures that investigations are handled with the highest level of expertise, oversight, and consistency, ultimately strengthening the organization's cybersecurity posture. Failure to comply with this policy could result in disciplinary action up to, and including implementation of a performance improvement plan.
