---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose
The purpose of this policy is to establish clear, timely, and tracked communication protocols within the Security Operations Center (SOC). Effective communication is essential to ensure operational continuity, rapid response to security incidents, and alignment with Cybersecurity Leadership directives. This policy sets forth expectations for SOC personnel, including SOC leadership, in handling and responding to communications.

## Scope

This policy applies to all SOC personnel, including SOC analysts, Shift Leads, and SOC leadership. It governs all forms of internal communication, including but not limited to instant messages, chats, emails, meetings, and phone calls. All communications must adhere to the organization's data privacy policy.
## Roles and Responsibilities

| Role           | Responsibility                                                                                                                                                                                                                                                                   |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SOC Analysts   | Understanding and following communications standards.Acknowledging, recording, and actioning requests.Handing off outstanding requests to following shifts.Documenting and distributing all communications.                                                          |
| SOC Leadership | Monitoring designated Teams chats, email distribution lists, and emergency hotlines.Ensuring that all communications are acknowledged and actioned properly.Ensuring handoff of open requests to following shifts. Ensuring action items from meetings are complete. |
| Note Taker     | Summarizing and distributing meeting minutes and action items.                                                                                                                                                                                                                   |

### Policy Statement

The SOC must maintain rigorous communication standards to ensure efficient operations and incident response. All communications from security leadership must be acknowledged, tracked, and shared broadly to guarantee awareness across shifts and geographies. Timely and transparent communication is critical to maintaining operational effectiveness and compliance with organizational policies.

#### 1. Communications Acknowledgement

- The SOC must acknowledge all communications from security leadership in dedicated instant messaging channel within 15 minutes or less, even if only to confirm receipt.
- All emails sent to the SOC from security leadership must be acknowledged as soon as possible but no later than **1 hour** from receipt.
- SOC leadership, including SOC Shift Leads, are responsible for monitoring Teams chats and email distributions to ensure compliance with acknowledgment expectations.

#### 2. Tracking and Transparency

- Any requests received via instant messaging from security leadership must be tracked appropriately:
    - Ticketing platform tickets for operational tasks or incidents.
    - Email tracking for general or informational requests.
- Communications should be shared as broadly as possible to ensure awareness across shifts and global SOC teams.
- No SOC business should be conducted in direct instant messages or via voice due to the risk of losing instructions. Any direct messages must be summarized and shared with the entire SOC team for transparency.
- Any request from security leadership that remains open by the end of a shift must be reassigned to the oncoming shift for continued tracking and remediation.

#### 3. Meetings and Documentation

- All SOC and leadership meetings must have a designated note taker to capture and distribute minutes after the meeting.
- Meeting minutes must include:
    - List of attendees.
    - Topics discussed.
    - Action items or follow-up commitments.
    - Responsible parties.
    - Expected due dates.
- In general, the junior-most person on the call should take notes.
- SOC analysts should only attend leadership meetings if they have something to contribute. If they do not actively contribute, they must take independent notes and circulate them to the designated note taker.

#### 4. Phone Call Documentation

- Any direct phone calls between the SOC and security leadership must be summarized and documented in:
    - Email communications.
    - Designated instant messaging channels.
- This ensures context, continuity, and transparency of communications.

#### 5. 24x7 Emergency Hotline

- The SOC must maintain a dedicated international emergency hotline available 24x7 for urgent communications.
- This mechanism should enable rapid escalation of critical issues to SOC analysts and leadership at any time.

#### 6. Compliance with Data Privacy Policies

- All SOC communications must adhere to the organization's data privacy policy to ensure the protection of sensitive information.
- Personnel must be mindful of confidentiality when documenting and sharing information.

#### 7. Language

- All SOC communications should be written in standard English.
- Translation to regional languages should be applied where feasible and appropriate
- Communications should adhere to standard business form and formality, under no circumstance should profane or offensive language be used in any medium including, but not limited to: email, voice, and instant messages.

## Enforcement and Compliance
By adhering to these communication standards, the SOC ensures a structured, transparent, and accountable approach to operational coordination and leadership directives. Non-compliance risks miscommunication and misunderstanding. SOC leadership is responsible for ensuring compliance with this policy.

## Policy Review
This policy will be reviewed at least annually by SOC leadership.

Effective Date:

|Last Reviewed By     | Date    |
| --- | --- |
|     |     |
