04 / Operate / Co-managed SOC
Co-Managed SOC forIT Teams
Your team and ours, on the same page.
Expert SOC coverage that strengthens your IT staff instead of replacing them.
What you get
- Shared visibility into alerts, cases and tooling
- Clear division of who handles what, agreed in writing
- Escalation to your staff with context, not just a ticket
- Engineering help when your team runs out of hours
How it works
We agree on a responsibility split with your IT team, set up shared workflows, and adjust the split as your team grows.
What to expect
Onboarding in 90 days
Your team and ours work from the same plan, with a shared responsibility matrix that says who does what.
Kickoff and discovery
Days 1 to 10 (days 1 to 14 for CMMC)
Stakeholders aligned, scope confirmed, discovery complete and access plan approved.
Visibility and access
Days 5 to 18 (days 7 to 21 for CMMC)
Privileged access in place, asset and identity baseline built, first log sources connected.
Tooling deployment
Days 10 to 30 (days 14 to 35 for CMMC)
EDR, SIEM, vulnerability and monitoring platforms deployed and reporting.
Baseline and tuning
Days 21 to 45 (days 28 to 50 for CMMC)
Security posture baseline and gap report, detection tuning, and the shared responsibility matrix finalized.
Go-live and handoff
Days 35 to 50 (days 45 to 60 for CMMC)
Runbooks live, service levels active, first reports delivered and formal acceptance.
Stabilization
Days 51 to 90 (days 61 to 90 for CMMC)
False positives reduced, trend reporting, your first quarterly business review and an improvement roadmap.
Windows are targets. Hybrid, multi-tenant or GCC High environments can take longer, and we agree a realistic schedule at kickoff. CMMC engagements also settle the CUI boundary during discovery.
Service levels
Monitoring retainers run 24x7. Unless your agreement sets its own, we work to these targets.
| Priority | Acknowledged within | Target response |
|---|---|---|
| Critical | 15 minutes | 4 hours |
| High | 1 hour | 8 hours |
| Medium | 4 hours | 24 hours |
| Low | 8 hours | 72 hours |
- Tickets confirmed to you within 1 hour and assigned to an analyst within 1 hour
- Status updates at least every 24 hours while a ticket is open
- A monthly security report in the first week of each month
- A quarterly business review in the first week of each quarter
These are default targets. If your agreement sets its own service levels, those take precedence.
Experienced a breach?
Call our 24/7 emergency line: 877-778-2476.
Bring us the complicated part.
Talk with a credentialed CISO and an accountable team. Email [email protected] or call (877) 77-vCISO.