---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose

The purpose of the policy is to safeguard the privacy of end users in the corporate environment. Whenever a member of the Security Operations Center (SOC) team intends to access information on an endpoint or cloud resource containing personal information it is vital to get formal approval for such access unless time constraints and risk to the organization require immediate action (such as in an incident response scenario).

## Scope

This policy applies to all SOC teammates.

## Roles and Responsibilities

| Role                       | Responsibility                                                                                             |
| -------------------------- | ---------------------------------------------------------------------------------------------------------- |
| SOC Analyst                | Seek formal approval before accessing any data on an end user machine.Record approval for later audit. |
| Legal, HR, or Data Privacy | Review requests and respond in a timely manner.                                                            |
### Policy Statement

In order to preserve the privacy of end users, members of the SOC team must seek formal approval prior to accessing any information on an end user machine. Because there are regional privacy implications to data access this approval must be submitted to legal and formally documented and accepted prior to any access.

## Policy Elements

#### **1. Endpoints not covered by this policy**

System data, such as configurations, logs, or program files on servers and other non-user machines are exempt from this policy. Note however, that end user data on servers is covered by this policy.

#### **2. Requesting access**

Access requests will follow appropriate SOP.

#### **3. Emergency bypass**

If, in the course of an emergency or incident response where time constraints preclude access request approval, SOC teammates may access end-user data without formal approval. Approval requests should still be sent via normal escalation channels should be informed of the emergency access.

#### **4. Non-emergency access**

All non-emergency access to employee data, such as via an HR request or a request from an employees manager must receive formal authorization.

## Enforcement and Compliance

Failure to comply with this policy could lead to disciplinary action.
