Engage
Command Centre / capability
Security Operations Centres (SOC)
SOC rooms fail on acoustics more often than displays: two concurrent incident bridges in an untreated room make both unusable. Sound separation is stated.
A SOC is a security function first and a room second. The room's only job is to make the function faster.
Which is why SOC rooms fail on things the tender never mentions. An analyst is on a conference bridge while an incident call runs four seats away. The wall is legible from three positions out of twelve. Access to the floor is controlled by the same badge that opens the canteen.
Where SECCOM stops. Detection content, use cases, correlation rules, playbooks and the analysts themselves sit with the security operations function. SECCOM builds the environment they work in.
Next step