Anita, the operations coordinator in our story, had a habit of walking the front office at closing time with a paper checklist: doors, registers, appointment diary, the lot. One evening a colleague asked a simple question. “Who walks the checklist for our computer systems?” Nobody had an answer. The following week Anita built one. This article follows her audit, one item at a time, as a way to introduce SOC Ops, the routine of watching systems for misuse and recording what was decided. Anita is invented, and the content is general operational information, not clinical or legal guidance.
Why a checklist at all
Appointment diaries, enquiry forms and messaging inboxes hold personal details that people expect to stay private. Someone has to notice when a login looks strange or a mailbox starts forwarding messages elsewhere. The Ops Atlas, whose entry on the discipline of SOC Ops Anita read over a weekend, puts it as turning alerts into timely, recorded decisions. Anita liked the word “recorded”. It meant her audit could be done by looking at paper trails rather than by guessing.
The audit, item by item
1. Is there a named owner for new alerts?
Anita started with people. Every alert needs a first reader, and that person needs a deputy. Her answer on day one was “whoever notices”, which she marked as a fail.
2. Are logs collected in one place?
The Atlas lists a standard, CIS Controls version 8.1, that asks for logs to be centralised, kept at least ninety days and reviewed weekly. Anita’s logs lived in three different dashboards, so she scheduled a consolidation and a Friday review slot.
3. Does every closed alert carry a reason?
Her notes showed items closed with a single word. She introduced four endings, taken from the Atlas: confirmed threat, benign trigger, mistaken alert and undetermined. A benign trigger might be a receptionist signing in from a home connection during a snowstorm. Writing that down, she realised, would spare the next person the same puzzle.
4. Which incidents happen monthly?
The Atlas suggests a rule: if an incident type occurs about once a month or more, it needs an approved written procedure. Anita listed three: suspicious sign-ins, requests to alter bank details on invoices, and lost devices. She drafted one page for each.
5. Who covers nights and weekends?
Nobody did. The Atlas relays a staffing rule of thumb from MITRE that a seat covered continuously requires roughly five people, and that no shift should have fewer than two. Anita’s clinic could not afford that, so she began comparing a managed service for out-of-hours cover while keeping the day-time queue in-house.
6. What does the handover look like?
She drafted a short pass-down form: open items, what has been checked, what has not, and who owns what. In the Atlas’s version, both parties sign and anything not accepted stays with the outgoing owner. It was a surprisingly small change with outsized effect.
7. How are waits measured?
Anita planned to time how long each alert waits before a human first opens it, reporting the typical wait and the near-worst wait for every shift. The Atlas explains why: one stale item can wreck an average, and nights hide inside it. She also resolved never to count an automatic action as a first look.
8. What may software do on its own?
The Atlas permits automated isolation just for rules with a track record, applied to everyday staff equipment at a throttled pace, and leaves critical assets to people. Anita wrote that into her own policy and added that any silenced alert rule must have an owner and an end date.
9. If we outsource, who is accountable?
Anita underlined the answer in her copy: the organisation. The Atlas cites MITRE for the point that owners and executives remain responsible even when another firm does the watching. She added a clause demanding named escalation contacts.
10. Is the monitoring system itself protected?
The consolidated logs would hold a map of every sensitive system, so access to them had to be narrower than access to anything else. The Atlas observes that if monitoring data leaks, an intruder can use it to erase the evidence of their own movements.
11. How do we know we are improving?
Anita booked a yearly self-assessment using SOC-CMM, a freely available model spanning five areas, plus a small tabletop exercise, in which staff talk through a made-up incident over coffee. Both appear in the Atlas’s description of everyday operation.
12. Are we confusing terms?
Finally she checked a vendor brochure that promised “SOC compliance”. It referred to an audit report, SOC 2, which the Atlas lists as unrelated to running a monitoring team. She sent the brochure back with a polite question.
Anita’s scorecard
Out of twelve items, she scored three passes, five partials and four fails. The result was not embarrassing; it was a to-do list. She posted it in the staff room with owners and dates, which is itself a SOC Ops habit: visible work, assigned people.
If you like writing things down, our guide to keeping gifts and bills under control with a festival-season budget plan will feel familiar, and so will the notes on maintaining a plain farm budget book and good money habits. Both rely on the same principle as the audit: an unrecorded task is an unmanaged one.
What Anita learned about talking to the team
The audit’s surprise was social. Colleagues who had shrugged at “security” became curious once the conversation turned into a checklist with names and dates. The receptionist offered to keep the handover form because she already kept the paper diary. The accounts clerk asked for a one-page procedure on payment-detail changes because she had received two odd emails the previous quarter. Anita concluded that people seldom resist a routine they helped design, and that the quickest early wins came from borrowing habits the office already trusted rather than introducing new vocabulary.
Take-away
You can run Anita’s audit in an afternoon with a pen and the twelve questions above. Start with the fails, fix the cheapest first, and repeat the checklist in three months.