The decision to outsource elements of the Security Operations Centre’s capability is among the most governance-sensitive strategic choices the security programme makes. The functions being outsourced are not peripheral business activities whose delegation creates the operational efficiency that standard outsourcing rationale supports. They are the detection of threats targeting the organisation’s most valuable assets, the investigation of incidents whose consequences the board’s governance accountability requires to be understood and managed, and the intelligence whose currency determines whether the organisation knows what adversaries are doing before or after they succeed. The governance discipline the SOC outsourcing decision demands therefore exceeds the standard third-party risk management framework’s commercial due diligence and contractual protection. It requires a principled analysis of the governance boundary that determines what the organisation can safely delegate without losing the security governance authority that internal control of critical functions provides.
What Must Remain Internal #
The functions the organisation must retain internally, regardless of the provider’s capability, the cost efficiency outsourcing would create, or the operational convenience delegation would provide, represent the governance boundary whose integrity the security programme’s accountability structure demands as the non-negotiable condition of any outsourcing arrangement.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
