Scope Enterprise Active

Security Operations & Monitoring

To maintain situational awareness of security events and manage security operations.

Domain ID
DOM-018
Domain Code
SOC
Business Owner
SOC

Domain Overview

SOC · Full Domain Profile
Short Overview

Establishes the processes for operating security operations centers, detecting threats, and automating security responses.

Description

Centralizes the operational aspects of security, including logging, monitoring, alerting, SIEM management, SOAR, and continuous threat detection.

Why This Domain Matters

Alert fatigue overwhelms analysts, making it difficult to distinguish critical threats from noise, while understaffed SOCs struggle to maintain 24x7 coverage.

Business Objectives

    Business Risks

      Common Challenges

        Key Capabilities

        Stakeholders, Industries & Technologies

        SOC · Operating Context

        Typical Stakeholders

        Applicable Industries

        Applicable Technologies

        Keywords & Tags

        Associated Controls Catalog

        4 Active Controls in Domain
        Control ID Control Name Category & Type Criticality Status Requirements Action
        SOC-001 Security Operations Center (SOC) Management Establishes SOC governance including rol...
        Administrative
        Detective
        		 Critical Active 📋 10 Reqs View →
        SOC-002 Security Threat Detection Establishes threat detection including u...
        Technical
        Detective
        		 Critical Active 📋 10 Reqs View →
        SOC-003 Security Automation & Orchestration (SOAR) Establishes SOAR including automated pla...
        Technical
        Corrective
        		 High Active 📋 10 Reqs View →
        SOC-004 Threat Hunting Establishes threat hunting including pla...
        Technical
        Detective
        		 High Active 📋 10 Reqs View →

        Compliance Requirements & Audit Crosswalk

        40 Specific Audit Clauses

        The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.

        REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
        SOC-001-R001 SOC Governance Framework The organization shall establish a Secur... SOC-001 Security Operations Center (SO... SOC Manager / CISO View ↗
        SOC-001-R002 SOC Roles & Responsibilities The organization shall clearly define an... SOC-001 Security Operations Center (SO... SOC Manager / CISO View ↗
        SOC-001-R003 SOC Operating Model The organization shall define the SOC op... SOC-001 Security Operations Center (SO... SOC Manager / CISO View ↗
        SOC-001-R004 SOC Service Management The organization shall manage SOC servic... SOC-001 Security Operations Center (SO... SOC Manager / CISO View ↗
        SOC-001-R005 SOC Resource Management The organization shall manage SOC resour... SOC-001 Security Operations Center (SO... SOC Manager / CISO View ↗
        SOC-001-R006 SOC Performance Monitoring The organization shall monitor SOC perfo... SOC-001 Security Operations Center (SO... SOC Manager / CISO View ↗
        SOC-001-R007 SOC Metrics & Reporting The organization shall define and track... SOC-001 Security Operations Center (SO... SOC Manager / CISO View ↗
        SOC-001-R008 SOC Review The organization shall conduct periodic... SOC-001 Security Operations Center (SO... SOC Manager / CISO View ↗
        SOC-001-R009 SOC Maturity Assessment The organization shall conduct periodic... SOC-001 Security Operations Center (SO... SOC Manager / CISO View ↗
        SOC-001-R010 Continuous Improvement The organization shall establish a conti... SOC-001 Security Operations Center (SO... SOC Manager / CISO View ↗
        SOC-002-R001 Threat Detection Framework The organization shall establish a threa... SOC-002 Security Threat Detection SOC / Security Engineering View ↗
        SOC-002-R002 Detection Use Cases The organization shall define threat det... SOC-002 Security Threat Detection SOC / Security Engineering View ↗
        SOC-002-R003 Detection Rules Management The organization shall manage threat det... SOC-002 Security Threat Detection SOC / Security Engineering View ↗
        SOC-002-R004 Behavioral Analytics The organization shall implement behavio... SOC-002 Security Threat Detection SOC / Security Engineering View ↗
        SOC-002-R005 Network Traffic Analysis The organization shall implement network... SOC-002 Security Threat Detection SOC / Security Engineering View ↗
        SOC-002-R006 Detection Validation The organization shall validate threat d... SOC-002 Security Threat Detection SOC / Security Engineering View ↗
        SOC-002-R007 Alert Prioritization The organization shall prioritize detect... SOC-002 Security Threat Detection SOC / Security Engineering View ↗
        SOC-002-R008 Detection Reporting The organization shall report on threat... SOC-002 Security Threat Detection SOC / Security Engineering View ↗
        SOC-002-R009 Detection Review The organization shall conduct periodic... SOC-002 Security Threat Detection SOC / Security Engineering View ↗
        SOC-002-R010 Continuous Improvement The organization shall establish a conti... SOC-002 Security Threat Detection SOC / Security Engineering View ↗
        SOC-003-R001 SOAR Governance Framework The organization shall establish a Secur... SOC-003 Security Automation & Orchestr... SOC / Detection Engineering View ↗
        SOC-003-R002 Automated Playbooks The organization shall develop and maint... SOC-003 Security Automation & Orchestr... SOC / Detection Engineering View ↗
        SOC-003-R003 Workflow Orchestration The organization shall implement workflo... SOC-003 Security Automation & Orchestr... SOC / Detection Engineering View ↗
        SOC-003-R004 Automated Response Actions The organization shall implement automat... SOC-003 Security Automation & Orchestr... SOC / Detection Engineering View ↗
        SOC-003-R005 Integration Management The organization shall manage integratio... SOC-003 Security Automation & Orchestr... SOC / Detection Engineering View ↗
        SOC-003-R006 Automation Monitoring The organization shall monitor SOAR capa... SOC-003 Security Automation & Orchestr... SOC / Detection Engineering View ↗
        SOC-003-R007 SOAR Performance Reporting The organization shall report on SOAR, p... SOC-003 Security Automation & Orchestr... SOC / Detection Engineering View ↗
        SOC-003-R008 SOAR Review The organization shall conduct periodic... SOC-003 Security Automation & Orchestr... SOC / Detection Engineering View ↗
        SOC-003-R009 Exception Management The organization shall manage exceptions... SOC-003 Security Automation & Orchestr... SOC / Detection Engineering View ↗
        SOC-003-R010 Continuous Improvement The organization shall establish a conti... SOC-003 Security Automation & Orchestr... SOC / Detection Engineering View ↗
        SOC-004-R001 Threat Hunting Framework The organization shall establish a threa... SOC-004 Threat Hunting SOC Analysts / Incident Response View ↗
        SOC-004-R002 Hunt Planning The organization shall conduct formal pl... SOC-004 Threat Hunting SOC Analysts / Incident Response View ↗
        SOC-004-R003 Threat Hypothesis Development The organization shall develop threat hy... SOC-004 Threat Hunting SOC Analysts / Incident Response View ↗
        SOC-004-R004 Hunt Execution The organization shall execute threat hu... SOC-004 Threat Hunting SOC Analysts / Incident Response View ↗
        SOC-004-R005 Threat Validation The organization shall validate threat h... SOC-004 Threat Hunting SOC Analysts / Incident Response View ↗
        SOC-004-R006 Hunt Documentation The organization shall maintain comprehe... SOC-004 Threat Hunting SOC Analysts / Incident Response View ↗
        SOC-004-R007 Hunt Reporting The organization shall report on threat... SOC-004 Threat Hunting SOC Analysts / Incident Response View ↗
        SOC-004-R008 Lessons Learned The organization shall capture and integ... SOC-004 Threat Hunting SOC Analysts / Incident Response View ↗
        SOC-004-R009 Hunt Review The organization shall conduct periodic... SOC-004 Threat Hunting SOC Analysts / Incident Response View ↗
        SOC-004-R010 Continuous Improvement The organization shall establish a conti... SOC-004 Threat Hunting SOC Analysts / Incident Response View ↗

        Cross-Mapped Regulatory Frameworks

        Harmonized Control Mappings
        Framework Code Framework Name & Description Family / Category Version Action
        MAPPED NIST SP 800-61 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        NIST-CSF NIST CSF (DE.AE) The NIST Cybersecurity Framework provide...
        NIST
        Framework
        		 v2 View →
        MAPPED MITRE ATT&CK Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED MITRE D3FEND Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED NIST SP 800-92 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        COBIT2019 COBIT (APO13) COBIT is an enterprise governance and ma...
        COBIT
        Governance Framework
        		 v2019 View →