Glossary
SOC (security operations center)
Also called: Security operations center
In one sentence
A SOC is a team — in-house or outsourced — whose job is to watch an organization's security alerts, investigate them and respond to attacks.
A security operations center is the people, processes and tools that monitor security around the clock. SOC analysts look at alerts from tools like EDR and SIEM, decide which are real, escalate serious incidents and coordinate the response. Large companies build their own; smaller organizations rent one through an MDR provider or an MSSP.
Don't confuse SOC with SOC 2. Same three letters, completely different meaning. SOC 2 is an audit report (System and Organization Controls) issued by a CPA firm under AICPA standards, showing a service company's security controls were checked. A security operations center is a team that watches for attacks. A vendor can have a SOC 2 report without running a SOC, and vice versa.
Why it matters for a small business: you'll see “SOC” in sales materials and insurance questionnaires. When a provider says “our SOC monitors your systems,” ask practical questions. Is it staffed by people around the clock, or is it automated alerting? Who are the analysts — employees or a third party? What can they do without calling you? How fast do they respond? Honest answers to these matter more than the label.
Example: a dental practice wants someone watching for attacks overnight. Rather than hiring analysts, it buys a managed service that includes a SOC (often sold as MDR), alongside its regular IT support. When an alert fires at night, the SOC isolates the affected computer, and the IT provider's team handles cleanup and communication with the practice in the morning.
Read our guide on choosing a managed IT provider for more questions to ask.
Related terms
- SOC 2An independent audit report, based on AICPA criteria, that shows how a service company protects the data it handles for its clients.
- MDR (managed detection and response)MDR is a service where a team of security analysts watches your security tools' alerts, investigates them, and takes action to contain threats on your behalf.
- MSSP (managed security service provider)An MSSP is a company that provides ongoing, outsourced security services — such as threat monitoring, log analysis and incident response — rather than general IT support.
- SIEM (security information and event management)A SIEM is a system that collects logs from across your environment in one place, keeps them, and analyzes them to spot and investigate security problems.
- EDR (endpoint detection and response)EDR is security software on each computer that watches for suspicious behavior, records what happens, and lets defenders stop and isolate an attack in progress.
- Incident response planA written, step-by-step plan for what your business does when a security incident happens — who to call, what to shut off and what to record.