Which of the following functions is the primary responsibility of a Security Operations Center (SOC)?

The primary function of a Security Operations Center (SOC) is to unify and coordinate an organization's security efforts. Its core mission involves the continuous monitoring of systems, networks, and data to detect potential cybersecurity threats in real-time. Upon detection, the SOC is responsible for analyzing, triaging, and responding to security incidents to mitigate impact and prevent future occurrences. This operational cycle of monitoring, detection, and response is the central purpose of a SOC, distinguishing it from other cybersecurity functions that focus on policy, development, or physical security.

A. Governance, Risk, and Compliance (GRC) teams are primarily responsible for audit and regulatory compliance, although a SOC provides essential data for these activities.

C. Managing physical security is the responsibility of a separate physical security department, not a cybersecurity-focused SOC, though they may collaborate on converged threats.

D. Secure software development is a function of development and application security (AppSec) teams operating within a Secure Software Development Lifecycle (SSDLC).

1. Carnegie Mellon University, Software Engineering Institute (SEI). (2021). Common Sense Guide to Security Operations Centers. Version 1.0. Section 2.1, "SOC Mission," p. 5. This guide states, "The mission of a SOC is to monitor, detect, analyze, respond to, and report on cybersecurity events and incidents."

2. National Institute of Standards and Technology (NIST). (August 2012). Special Publication 800-61 Rev. 2, Computer Security Incident Handling Guide. Section 2.3.2, "Central Incident Response Team," p. 2-4. This document describes the functions of a central team, analogous to a SOC, which include receiving, triaging, and responding to incidents.

3. P. M. T. B. Sandanayake, A. S. Karunananda, and A. A. P. A. D. Adikari, "A Model for Security Operation Center (SOC) to Detect and Mitigate Advanced Persistent Threats," 2018 18th International Conference on Advances in ICT for Emerging Regions (ICTer), Colombo, Sri Lanka, 2018, pp. 1-8, doi: 10.1109/ICTER.2018.8615511. Section II-A, "Security Operation Center (SOC)," describes the SOC's role as "a centralized unit that deals with security issues... by continuous monitoring and analysis of data activity."