---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose

The purpose of this policy is to provide guidance to the Security Operations Center (SOC) on minimizing business impact or interruption by ensuring thorough evaluation of the validity of use or communication with any resource prior to blocking that resource. This policy aims to balance the need for security with the necessity of maintaining uninterrupted business operations. The SOC Director is available to address any ambiguity or to consult on relevant impacts.

## Scope

This policy applies to all SOC personnel and activities related to the monitoring, detection, and response to security incidents. It encompasses all actions taken to block or delete malicious domains, email senders, processes, and other potentially harmful resources.

Roles and Responsibilities

| Role           | Responsibility                                                                                                                                                                                                                     |
| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SOC Analyst    | Responsible for evaluating the validity of use or communication with any resource before taking action to block or delete it. They must ensure that containment activities do not negatively impact legitimate business processes. |
| SOC Managers   | Oversees the implementation of this policy and ensures that SOC personnel are adequately trained and informed about the policy requirements.                                                                                       |
| Business Owner | Consulted and informed in cases where there is potential business impact due to SOC actions.                                                                                                                                       |
| SOC Director   | Handles escalations in cases of ambiguity or uncertainty regarding the impact of SOC actions.                                                                                                                                      |
### Policy Statement

The SOC must make every effort to minimize business impact or interruption by thoroughly evaluating the validity of use or communication with any resource prior to blocking that resource. While it is crucial to block malicious domains, email senders, processes, etc., every effort should be made to ensure that such containment activities do not negatively impact legitimate business processes or cause unnecessary disruption.

## Policy Elements

- **Evaluation of Validity**
    1. SOC personnel must assess whether there is valid use or communication with any resource before taking action to block or delete it.
- **Impact Assessment**
    1. SOC personnel must scope the potential impact of any block or deletion to ensure there is no negative outcome for the organization
- **Proportional Response**
    1. Actions taken must be proportionate to the threat level. SOC personnel must conduct sufficient research to justify any block, deletion, or process interruption.
- **Consultation and Communication**
    1. In cases of potential business impact, the appropriate business owner or representative must be consulted and informed.
- **Escalation**
    1. If there is any ambiguity or uncertainty, cases should be escalated to the SOC Director

## Compliance and Enforcement
Failure to comply with this policy may result in disciplinary action, up to and including termination of employment. Non-compliance may also lead to unintended business disruptions, which could have significant operational and financial consequences.
