Which SOC provider has the fastest response?
| Response stage | Evidence to request |
|---|---|
| Acknowledge | When the alert is accepted by a human analyst |
| Investigate | When identity, endpoint, email, cloud and network context is reviewed |
| Notify | When the named customer contacts are reached and through which channels |
| Contain | Which actions analysts may take, such as isolating a device or disabling an account |
| Report | Timeline, findings, actions, open risks and next steps |
Response time needs a precise definition
Providers may measure time from alert creation, platform ingestion, analyst acknowledgement, investigation start or customer notification. Those are different milestones. A meaningful service description explains the starting event, severity level, coverage hours and exceptions.
What alert triage should accomplish
- Validate whether an alert represents suspicious or expected activity
- Add identity, endpoint, email, cloud and network context
- Assign a clear severity based on business impact
- Escalate confirmed or high-risk activity through agreed channels
- Document findings, recommended actions and response taken
Questions for a SOC-as-a-Service provider
- Is monitoring staffed 24/7 or only alert forwarding?
- Which events receive human investigation?
- How are critical, high, medium and low severity events defined?
- What are the acknowledgement, investigation and notification targets?
- Can analysts isolate endpoints, disable accounts or block indicators?
- How are false positives tuned and recurring issues reviewed?
- What reporting shows service performance and unresolved risk?
Small businesses need clear ownership
A small business may not have an internal security team available after hours. The contract should therefore make responsibilities explicit: what the provider investigates, what it can contain, who the customer calls and what happens when a primary contact does not answer.
What should a Toronto SMB ask before signing?
Request a sample severity matrix, escalation workflow and monthly performance report. The documents should show who owns each decision when a critical alert arrives after hours.
Related: SOC monitoring, MDR vs SIEM vs SOC, and Managed SOC services.
Need guidance specific to your environment?
Start with a focused review of your current controls, monitoring coverage and response responsibilities.