The Security Operations Center (SOC) is an important element of any organization’s cybersecurity strategy. Staffed by a team of security analysts and incident responders who work together to detect, analyze, respond to, report on, and prevent data breaches.
It’s an important role — the SOC is a company’s first line of defense against cybersecurity threats, and also the team responsible for continuously monitoring and improving an organization’s security posture — but it’s critical that an SOC gets continuing buy-in from leadership.
According to a report from Arctic Wolf, the average cost of establishing an SOC is $1.4 million, and the ongoing operational costs are also significant. To keep the C-suite apprised of ongoing threats — and to justify their budget — the SOC should make regular reports to executives.
What should that report include? Below is a template your SOC management can use for summary reporting to your own organization’s C-suite.
A SOC report template
Before you get started, remember that your executives likely do not understand technology, data breaches, or cybersecurity as well as you or the managers of the SOC do. You’ll need to keep your audience in mind as you draft, being as clear as possible and using non-technical language.
Focus on the important information: the items your leadership needs to know now, action items, and immediate needs. Use easy to understand visuals and metrics (like security ratings) where it’s possible to make the report easy to read.
Good, clear communication is vital here. Just 15% of organizations say their information security reporting fully meets their expectations, according to research from EY. You’ll need to go beyond the specific information in the report. Provide context by explaining what it means to the organization as a whole — how does it affect progress toward goals, what do metrics mean when compared with historical metrics, and how do specific risks affect specific parts of the business?
Your report should include the following sections:
Key findings
This section, which begins the report, is a summary of the most important items in the report. It should be written in clear language and offered with visualizations and metrics that allow executives and board members to understand the organization’s security posture and risk profile at a glance.
Monitoring summary
This section is a summary of networks, devices, and servers that were monitored for the report. List the number and location of everything that was monitored for the report, as well as the devices that weren’t monitored, so executives know what was not monitored — and why a gap exists.
Incident summary
This is a list of the number of incidents that were detected and resolved. In his section, you’ll also provide information about the incidents, such as their type, how long it took to detect and resolve each issue, the severity of each incident, and the actions the SOC team member took to resolve each incident.
Threat summary
Whereas the previous section was a list of every incident your organization experienced during a certain period of time, this section is for only the most critical threats, breaches or attacks.
In this section, delve into those threats in more detail – explain what they were, how they were handled, and again, put them into context. Are such attacks consistent with risk trends? How did it affect the business? Can the organization expect more? What can the company do to prepare for more such threats?
Recommendations
This last section is the part of the report where your team — or the manager who writes the report —focuses on action items that will help an organization improve their cybersecurity posture moving forward.
Action items can include a range of actions and activities, such as a request for more budget for the SOC, or a request for an investment in specific cybersecurity tools.
Recommendations may also include other actions, such as a need for organization-wide cybersecurity awareness training, or specific plans to be put in place to protect data and business processes if a data breach does occur.
How can SecurityScorecard help?
It’s important that reports to executives convey as much information as clearly and quickly as possible. SecurityScorecard’s A-F ratings measure an organization’s security posture across 10 security factors. A company’s total security score is a weighted average of these 10 factors, and will tell leadership at a glance what your security posture is.
Your organization’s Scorecard, which shows all 10 scores — quickly shows leadership how your organization is doing when it comes to application security, DNS health, network security, and other important security factors.
The scores are easy to read, understandable and can quickly be integrated into a report to leadership or the board, so that your leaders will know, at a glance, your organization’s security posture.
