Do you need a security assessment before a managed SOC?

No. A full security assessment is not a prerequisite for a managed SOC. What you do need is a focused baseline: which endpoints, servers and cloud services to monitor, who holds privileged access, which EDR is deployed, where backups live and who to call when an alert fires. That inventory takes days, not months.

This article belongs to our implementation series, introduced in How to implement a managed SOC. It answers a question MSPs often raise when onboarding their first client onto a SOC.

Full audit or baseline: two different exercises

A security audit is an in-depth evaluation: architecture and configuration reviews, penetration testing, organisational analysis. In France, ANSSI qualifies audit providers under its PASSI framework. It is a valuable exercise, but a long one, designed to produce an organisation-wide action plan.

A pre-SOC baseline has a narrower goal: give the SOC what it needs to monitor properly from day one. It does not try to fix everything, only to know what exists.

	Security audit	Pre-SOC baseline
Goal	Assess overall security posture	Prepare monitoring
Duration	Several weeks	A few days
Output	Report and action plan	Inventory and contacts
Needed to go live	No	Yes, in a simple form

What the baseline should cover

For a mid-sized client, the MSP can usually assemble it from what it already manages:

• Scope: number of endpoints and servers, Microsoft 365 or Google Workspace tenant, firewalls.
• Sensitive accounts: domain and cloud tenant admins, service accounts, third-party access.
• EDR: is it deployed everywhere? Cyna integrates natively with SentinelOne and Microsoft Defender. If the client has no EDR, or runs another one, the terms (scope, licences, support for a possible migration) are set out in the contract concluded with the partner MSP. See Do you need an EDR for a managed SOC?.
• Backups: where they are, whether they are isolated, when they were last tested.
• Contacts: who to call at the MSP and at the client, at what hours, for which severity.

The detail is covered in What information should you give a managed SOC at onboarding?.

Why you should not wait for an audit

Running a full audit before the SOC pushes monitoring back by weeks. Meanwhile the client has no detection, even though any weaknesses are already there. Monitoring does not replace remediation, but it lets you spot an attack that exploits a gap you have not closed yet.

Connection itself is quick: with ready-made connectors (Microsoft 365, Google Workspace, Stormshield, Fortinet), connecting an environment is quick and does not require a heavy project. See How long does it take to deploy a managed SOC?.

The SOC as a first diagnosis

The first weeks of monitoring often work as a diagnosis in their own right. The SOC sees dormant accounts still in use, sign-ins from unexpected countries, endpoints without EDR, suspicious mailbox forwarding rules. On the Cyna platform, the vulnerability dashboard and the exportable monthly report give the MSP a concrete list of items to address.

Those findings make a sound basis for a deeper audit if the client needs one, for instance ahead of NIS2 or ISO 27001 work. The audit is then targeted and easier to justify. See Does a managed SOC help with NIS2?.

When an upfront assessment still makes sense

An assessment before go-live remains relevant in a few cases:

1. After a recent incident: you first need to confirm the attacker has left. That is a job for incident response, not a standard audit. See How do you know the attacker is gone?.
2. When taking over an estate: if an MSP inherits a client with no documentation, a deeper inventory is needed.
3. For a contractual or regulatory requirement: some clients must provide an audit report to a customer or an insurer.

In every other case, the most effective order is: baseline, connection, monitoring, then a targeted audit if the findings warrant it. Basic good practice, such as ANSSI’s IT hygiene guide, can be rolled out in parallel.

Talk to an expert

Preparing to bring a client under SOC monitoring and wondering where to start? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Is a penetration test useful before connecting a SOC?

Not as a starting condition. It becomes valuable once the SOC is live, because it shows whether the simulated techniques are actually detected and escalated.

Who prepares the baseline: the MSP or the SOC?

The MSP, who knows the client's estate, prepares it. The SOC specifies what it needs and adds its own findings, for example through the vulnerability dashboard.

What if the client was audited recently?

That is a good starting point. The audit report and its action plan help decide which log sources and detection rules to prioritise.

Should every weakness be fixed before go-live?

No. Being monitored while you remediate is better than staying blind. See Managed SOC implementation mistakes to avoid.