What should a monitoring contract say if our insurer asks about a SOC or response times?

It should state who watches, when, how fast they respond and what they are allowed to do. A security operations centre (SOCSOC: security operations centre. A team, often working around the clock, whose job is to watch for and respond to attacks.) is a team that monitors security alerts and responds to them, either in-house or bought as a service. When insurers ask about one, they look for a few concrete points: hours of coverage, including nights and weekends; a response time for urgent alerts, written as a service level agreement (SLA); which systems and data sources are covered; the actions the provider may take without asking, such as isolating a device or disabling an account; how and when you are informed; and what happens during the provider’s own outages. Make sure the scope in the contract matches the scope you declare, since a SOC that only sees your firewall does not cover your laptops. NetSenX can be one of the data sources such a team uses, with alerts sent to Slack or a webhook from the Pro plan and SIEMSIEM: security information and event management. A system that collects logs from many systems and looks for patterns across them. export from the Business plan. NetSenX does not sell SOC services.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on Cyber insuranceAll topics