---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose
This policy applies to all personnel, third parties, partners, and external entities who may need to report cybersecurity-related events or concerns to the organization. It also applies to the internal Security Operations Center (SOC) team responsible for monitoring and managing the security reporting mailbox.

This policy governs the use, maintenance, and monitoring of the shared mailbox designated for reporting cybersecurity incidents, vulnerabilities, third-party compromises, and any other security concerns relevant to the organization’s operational security, legal obligations, or regulatory compliance.
## Scope
This policy applies to the entire organization in order to maintain a centralized reporting capability that can be triaged by the SOC and forwarded to other appropriate teams.
## Roles and Responsibilities

| Role                                                      | Responsibility                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| --------------------------------------------------------- |   |
| Security Operations Center (SOC)                          | Maintain and monitor the security reporting mailbox on a 24x7 basis.Triage and route incoming messages to appropriate teams, such as:    - Vulnerability Management    - Incident Response    - Legal/Compliance    - Human Resources    - Physical Security    - Privacy/DP Teams (if applicable)Maintain logs and audit trails of all incoming reports and actions taken.Acknowledge receipt of external submissions within a defined SLA (e.g., 4 hours).Ensure mailbox availability, security, and access control. |
| Vulnerability Management and Incident Response (IR) Teams | Respond to referrals from the SOC with timely investigation and remediation steps.Report findings and outcomes back to SOC for central tracking.                                                                                                                                                                                                                                                                                                                                                                                                           |
| Legal, HR, Other Stakeholders                             | Collaborate with SOC for any legal, contractual, HR, or physical concerns flagged via the mailbox.Determine legal or contractual obligations triggered by reports.                                                                                                                                                                                                                                                                                                                                                                                         |
| IT and Systems Admin                                      | Support SOC with technical analysis or containment actions where required.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |

## Policy Statement
The organization shall maintain a designated security reporting mailbox to serve as a single point of contact for all cybersecurity-related disclosures, concerns, or incident reports. This mailbox is monitored 24x7 by the SOC to ensure timely detection, coordination, and escalation of cybersecurity threats, including those reported by third parties.

Use of this mailbox ensures appropriate legal, compliance, and risk-based handling of reports and supports contractual and regulatory obligations for timely notification and response.
### Policy Elements

1. **Mailbox Designation and Maintenance**
    - A clearly named email address (e.g., `security@organization.com`) shall be designated for receiving reports.
    - The mailbox must be a shared, access-controlled inbox restricted to SOC personnel and designated backup roles.
    - The mailbox must support logging and message archival in accordance with organizational data retention policies.

2. **24x7 Monitoring**
    - The SOC must continuously monitor the mailbox, including during holidays and non-business hours.
    - Automated alerts (e.g., via SIEM or ticketing integration) should be configured to ensure timely awareness.
        
3. **Triage and Routing**
    - SOC personnel must review and classify each inbound message.
    - Messages must be escalated or routed to appropriate internal teams based on content and severity.
        
4. **Response and Acknowledgment**
    - All external messages must receive an acknowledgment within the organization's defined SLA (e.g., 4 hours).
    - High-priority reports (e.g., zero-day vulnerabilities, active breaches) must be escalated immediately.
        
5. **Logging and Audit**
    - All interactions, responses, and escalations must be tracked in the incident or case management system.
    - SOC must generate monthly summary reports outlining mailbox activity, trends, and unresolved issues.
        
6. **Compliance and Legal Considerations**
    - The mailbox must support the organization’s compliance with contractual obligations, including breach notifications.
    - Legal counsel must be consulted for reports that may involve regulatory reporting, contractual implications, or litigation risks.
        
7. **Mailbox Security**
    - Multi-factor authentication (MFA) must be enforced for all users with access to the mailbox.
    - Regular access reviews must be conducted to ensure only authorized personnel have access.

## Enforcement and Compliance
Failure to comply with this policy may result in disciplinary action, up to and including termination, depending on the nature and severity of the non-compliance. Unauthorized access, misuse, or failure to appropriately respond to inbound security reports may result in both internal disciplinary and external legal action.

The SOC Manager is responsible for ensuring enforcement of this policy and will conduct quarterly reviews of mailbox operations and compliance with this policy.

Audits may be performed by the internal audit team or external assessors to validate the effectiveness and integrity of the mailbox management process. Any deviations or incidents of non-compliance must be documented and remediated within defined timelines.

## Policy Review
This policy will be reviewed annually by all employees to ensure its continued relevance and effectiveness. Feedback and suggestions for improvement are welcome and should be directed to the SOC Leadership.

Effective Date:

|Last Reviewed By     | Date    |
| --- | --- |
|     |     |
