Description

A focused course, tailored for you

The SOC Assessment Officer Playbook

Map detection gaps to MITRE ATT&CK, score SOC maturity with evidence, and deliver assessment reports that CISOs act on.

A Security Operations Centre assessment is only as credible as the evidence behind the maturity score. When the detection coverage percentage, the MTTD baseline, and the gap-to-roadmap logic are all defensible, the CISO signs the report and budgets for the roadmap. When any of the three is soft, the assessment becomes a negotiation.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

SOC Assessment Officers carry a specific accountability: producing a maturity score that stands up when the client's team challenges it. The SIEM claims to cover 80% of the environment. The EDR deployment log says different. The MTTD is reported as 4 hours. The ticketing data suggests 11. The gap analysis lists 23 items but only 6 have clear ownership or budget paths. Every gap between what the client believes about their SOC and what the evidence shows is a section of the assessment report that will be argued in the findings readout. This course is built for the practitioner who needs to produce a defensible score, not just a documented one.

What you walk away with

Run a structured SOC assessment from scoping through CISO report delivery.
Build a MITRE ATT&CK detection coverage heatmap from live SIEM rule exports.
Score SOC maturity across detection, response, intelligence, and governance dimensions with evidence-backed ratings.
Produce a gap-to-roadmap translation that clients budget against.
Write an assessment report that holds up under internal audit and board review.
Present maturity findings to a CISO audience and defend scores under challenge.

The 12 modules

Module 1. Scoping a SOC Assessment

Before the first stakeholder interview, the scope document locks what is in and what is out. This module covers how to define assessment boundaries across physical SOC locations, managed service overlays, and hybrid environments. You will build a scoping questionnaire that surfaces the right evidence sources, set expectations with the client CISO on deliverables, and create a day-one interview plan that gets to process truth rather than process documentation.

Module 2. Evidence Collection Methodology

Assessment quality lives in the evidence tier. This module covers the three-tier evidence hierarchy used in SOC assessments: policy documentation, process observation, and tool telemetry. You will learn which document requests actually yield usable signal, how to validate claimed capabilities against actual log volumes and rule counts, and how to record evidence in a way that makes the maturity score defensible when the client's team pushes back.

Module 3. SIEM Coverage Analysis and MITRE ATT&CK Mapping

A SOC's detection capability is only as wide as the SIEM rules that fire. This module walks through the coverage analysis methodology: exporting active detection rules, mapping each rule to a MITRE ATT&CK technique, calculating coverage heatmap percentages by tactic and technique, and identifying the critical blind spots. You will produce the heatmap artefact that anchors the detection capability section of the final assessment report.

Module 4. Endpoint and Network Telemetry Assessment

Most SOCs claim full endpoint coverage but carry 20 to 40 percent dark assets. This module covers how to validate EDR deployment breadth against the client's asset inventory, how to assess NetFlow and NDR coverage across network segments, and how to map telemetry gaps to the detection blind spots identified in the MITRE ATT&CK heatmap. The output is a coverage gap table that feeds directly into the roadmap prioritisation.

Module 5. Alert Quality and Fidelity Scoring

Alert fidelity tells you whether the SOC is drowning in noise or finding real threats. This module covers how to pull a 30-day alert sample, categorise by true positive, false positive, and informational, calculate fidelity ratios by detection source, and benchmark against industry reference points. You will build the alert quality scorecard that most SOC assessments present as a single percentage but rarely explain how they derived.

Module 6. SOC Metrics Benchmarking

MTTD, MTTR, and escalation latency are the three numbers the CISO will ask you to benchmark against peers. This module covers how to extract reliable MTTD and MTTR figures from ticketing system data, how to normalise across incident severity tiers, and how to apply industry benchmark ranges without overstating what the data supports. The output is the metrics baseline section of the assessment that CISOs cite in board reporting.

Module 7. Incident Response Process Assessment

IR process maturity is assessed against the documented playbooks, the actual escalation logs, and the exercises the team has run. This module covers how to evaluate IR playbook coverage across NIST 800-61 and SANS PICERL phases, how to test escalation path clarity through structured interviews with tier-1 and tier-2 analysts, and how to score crisis communication protocols from CISO to executive team. Each gap feeds the process roadmap.

Module 8. Threat Intelligence Operationalization Review

Most SOCs subscribe to threat feeds but few operationalise them into detection tuning. This module covers how to assess the TI-to-detection pipeline: which feeds are ingested, how IOCs are converted to detection rules, how TTP profiles update hunting hypotheses, and whether threat reports reach the analysts who write the detections. You will build the TI operationalisation scorecard that distinguishes a tactical feed collector from a mature intelligence-driven SOC.

Module 9. People, Governance and Tier Architecture Assessment

Staffing ratios and tier architecture determine whether the SOC can sustain the alert volume it generates. This module covers how to assess analyst-to-alert ratios, tier-one escalation criteria, shift coverage models, and analyst skills against the detection portfolio. You will use the SOC staffing framework to score governance maturity, identify single points of failure in the on-call model, and build the organisational gap section of the assessment.

Module 10. Tooling Stack Evaluation

The tooling section of a SOC assessment is where clients expect a verdict on their technology investments. This module covers how to assess SIEM, SOAR, EDR, NDR, and threat intelligence platform maturity against capability benchmarks, how to map tool gaps to detection blind spots already identified, and how to avoid the trap of recommending additional tooling when process gaps are the primary driver of low maturity scores.

Module 11. Gap Analysis and Roadmap Development

The gap analysis translates every scored finding into a prioritised action. This module covers how to build the gap register across detection, response, intelligence, and governance dimensions, how to score each gap by risk impact and implementation complexity, and how to sequence roadmap items into a 90-day quick win tier and a 12-month structural improvement tier. The roadmap is the deliverable the client CISO presents to their own leadership.

Module 12. Writing the Assessment Report and Presenting to the CISO

The assessment report is the product the client paid for. This module covers the executive summary structure that lands with a non-technical board, the technical findings section that holds up under internal audit review, and the oral presentation approach that defends maturity scores when the client's SOC director pushes back on the ratings. You will produce a report template calibrated to the consulting engagement context and peer benchmarking expectations.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

The scoping session with the CISO is complete and you need to build a structured evidence collection plan.

The SIEM rule export is on your desk and you need to map it to MITRE ATT&CK coverage.

The findings are ready and you need to translate them into a prioritised roadmap the client will implement.

The report is complete and you are presenting the maturity score to a CISO who disputes the detection coverage rating.

What you get with this course

12 written modules covering the full SOC assessment lifecycle from scoping to CISO presentation.
Detection coverage heatmap template for MITRE ATT&CK mapping.
SOC maturity scorecard with evidence anchoring guidelines for each dimension.
Gap register and roadmap prioritisation framework.
Assessment report template with executive summary and technical findings structure.
Alert quality and metrics baseline scoring worksheets.
Hand-built implementation playbook tailored to your specific assessment context, delivered alongside course access.

What you will have in hand by Day 1, Week 1, Month 1

Course access provisioned within 24 hours of purchase.

Hand-built implementation playbook delivered alongside course access.

Before and after

Before

Assessment reports that lose credibility when clients push back on maturity scores, detection coverage percentages that rest on claimed capability rather than rule-level evidence, and roadmaps that list gaps without ownership or sequencing.

After

A structured methodology that produces evidence-anchored maturity scores, a MITRE ATT&CK coverage heatmap built from actual SIEM rule exports, and a gap-to-roadmap translation the CISO can take to the board.

What happens if you do not address this

SOC assessments produced without a structured evidence methodology tend to produce scores the client disputes and roadmaps the client shelves. The reputational cost of a challenged assessment follows into the next engagement.

Who it is for

Security Operations Centre Assessment Officers and cybersecurity consultants who conduct SOC capability reviews for enterprise clients. You work across the assessment lifecycle from scoping through report delivery, you interface with CISOs and SOC Directors, and the quality of your deliverables is judged against the same frameworks your clients are trying to mature against.

Who this is NOT for. Security analysts working inside a SOC on day-to-day operations. Also not for GRC practitioners who assess policy compliance rather than operational detection and response capability.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Each module is designed to complete in 45 to 60 minutes. The full 12-module course can be worked through in a focused week or spread across three to four weeks alongside active assessment engagements.

Why $199 is the right number

Published SOC assessment frameworks (SOC-CMM, CREST, others) provide maturity models but not the practitioner methodology for evidence collection, coverage analysis, and report delivery. This course fills the operational gap between knowing the framework and running the assessment.

FAQ

Is this course relevant to assessments done under a specific framework like NIST CSF or ISO 27001?

The methodology in the course is framework-agnostic but includes specific guidance on mapping findings to NIST CSF, MITRE ATT&CK, and CIS Controls, which are the three most commonly referenced standards in enterprise SOC assessments.

Does the course cover assessments of managed SOC providers as well as internal SOCs?

Yes. Module 1 covers scoping across internal, hybrid, and managed service SOC models, and the evidence collection methodology in Module 2 addresses the documentation access limitations common in MSSP assessments.

How is this different from a general cybersecurity consulting course?

This course is built for the assessment practitioner, not the generalist consultant. Every module is anchored to the specific artefacts produced in a SOC assessment engagement: heatmaps, scorecards, gap registers, and assessment reports.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.