SOC Maturity Assessment (SOC-CMM)

In plain terms

The SOC-CMM is an open maturity and capability model for security operations, built from academic research by Rob van Os and used worldwide to benchmark SOCs. It assesses five domains — Business, People, Process, Technology and Services — and scores each on maturity and capability separately, which matters: a SOC can own excellent tooling and still score badly because nothing about how it runs is defined or measured. We run the assessment, validate the answers through interviews and evidence rather than self-report, and hand back a scored baseline with a roadmap you can re-run next year to show movement.

What you get

• Scored assessment across all five SOC-CMM domains, maturity and capability rated separately
• Evidence-validated answers — interviews and artefacts, not a self-assessment questionnaire
• Domain and element level heat map showing exactly where the weakness sits
• Target maturity profile appropriate to your threat exposure, not a blanket “aim for level 5”
• Prioritised improvement roadmap, and a baseline you can re-run annually

Who it is for

Organisations running an internal or hybrid SOC, those about to build one, and those who have inherited a SOC and cannot tell whether it is any good.