How do you assess a SOC provider's incident response capability?

To assess a SOC provider’s incident response capability, check six things: whether response is included in the contract, how quickly the team mobilises, who responds and with what skills, which actions can be taken remotely, which method is followed, and what deliverables you receive, particularly for regulatory reporting. Ask for written answers, not verbal promises.

This article expands on one of the criteria in our guide How to choose a SOC provider.

Why it deserves separate scrutiny

A SOC can be excellent at detection and poor at response. Once an incident is confirmed, someone has to contain, investigate, eradicate and support recovery. If that next step is not organised in advance, the first hour of the crisis is lost finding a team, negotiating a quote and briefing responders on the context.

Six criteria

Criterion	What to check	Question to ask
Contract	Response included, retainer, or quote on the day	What happens contractually once the incident is confirmed?
Mobilisation	Response time, on-call cover, emergency channel	How long between my call and a responder actually working?
Team	In-house or partner, skills, size	Who responds, and do they have the SOC’s context?
Remote actions	Isolating devices, disabling accounts	What can you do without travelling, and with what approval?
Method	Framework followed, evidence preservation	Which framework is your method based on?
Deliverables	Timeline, report, input for regulatory reporting	What will you give me, and when?

The contract: included, retainer or quote

There are three models: response included in the SOC service, an incident response contract signed in advance (retainer), or a quote at the time of the incident. The third is the riskiest, because negotiation starts mid-crisis. See What is an incident response retainer?.

Mobilisation

Ask for a written response time that applies at night and at weekends, and an emergency channel known in advance: an on-call number or a dedicated page. Check what that time actually covers: a first call back, or the start of the investigation?

The team and its skills

ANSSI’s PRIS framework, version 3.2, lists the activities an incident response provider can have qualified in France: searching for indicators of compromise, digital forensics, malware analysis, steering and coordinating investigations, and cyber crisis management. It is a useful checklist to confirm the team covers the full need.

One point that is often overlooked: continuity between detection and response. A team with access to the SOC’s logs, alerts and history gets going faster than an outside team discovering the environment from scratch.

The method

Ask which framework the method is based on. In April 2025, NIST published Revision 3 of its SP 800-61 guide, which ties incident response into overall cybersecurity risk management. How evidence is preserved during containment is a good test of maturity: isolating a machine should not mean wiping the traces needed for the investigation.

Deliverables

The provider usually supplies a timeline, an incident report and recommendations. For entities in scope of NIS2, these feed the early warning within 24 hours, the notification within 72 hours and the final report within one month (Article 23). Where personal data is breached, the GDPR requires notifying the supervisory authority within 72 hours of becoming aware of it (Article 33). Reporting remains the responsibility of the organisation concerned, but it depends on the quality of the facts provided. See What does an incident report contain?.

Evidence to ask for

• An anonymised sample incident report.
• The written escalation procedure, with contacts and pre-approved actions.
• A published or verbal lessons-learned review.
• The option of a tabletop exercise before or after signing.

How Cyna approaches it

Cyna’s CERT, a member of InterCERT France, works with the managed SOC and has access to its context. The CERT can be mobilised quickly, and the incident response on-call team is available 24/7 from the Report an incident page. The terms of the SOC service (scope, licences) are set out in the contract agreed with the partner MSP. Cyna’s certifications and security documents are available on its Trust Center. For an idea of what the team handles, see Lessons learned from cyberattacks handled by Cyna’s SOC and CERT in 2025.

Talk to an expert

Want to check the incident response capability of your current SOC or of an offer you are considering? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Must a SOC handle incident response itself?

No, it can rely on a partner. But you then need to know that partner, its response time and how information flows between the two teams. A poorly prepared handover wastes time at the worst moment.

Do you need a PRIS-qualified provider?

No general rule requires it for SMEs and mid-sized firms. ANSSI's PRIS qualification remains a useful benchmark for the skills to expect. See What is a PRIS-qualified incident response provider?.

Can you test a provider's incident response before a real incident?

Yes, with a tabletop exercise: an attack scenario walked through with the provider, the MSP and the client. It shows who calls whom, who decides and what is missing from the procedure.

Does incident response include restoring systems?

Not always. Scope varies from one provider to another and should be written down, including who rebuilds systems and restores backups.