SOCOPSFoundation
Maturity

How far along are you?

The five-level maturity model describes how an organization operates SocOps, from reactive and manual to continuous and self-correcting. Most teams should treat Levels 4 and 5 as a horizon, not a starting point. Maturity is earned in order. Tap a level to see what it looks like and how to climb.

↑ earned in order, one level at a time
Level L3
Continuous Evidence

Machine-readable logs and integrations capture evidence as systems operate.

Sounds like

"Evidence collects itself."

Focus here

Tie collected telemetry back to specific control objectives.

Evidence at this level

Automated configuration snapshots mapped to controls.

Watch for

Streams of data that no one maps to a control.

To climb from here

Turn that telemetry into live risk indicators.

v1.0 · validation draftRead it, then tell us where it falls apart.
Get involvedSupport the standard