Ongoing service plan
Enterprise — NOC + SOC
Security and availability in one coordinated process
Combine the full agreed NOC and SOC scope under coordinated incident management. Add basic vulnerability management, scheduled hunting and reviews that help address the causes of future disruption.
Core scope
What is included in Enterprise — NOC + SOC?
One process leads from detection through containment and service restoration to actions reducing the risk of recurrence.
Coordinated incident management
One coordinator for incidents involving security and availability, with shared priorities, a common timeline and an agreed sequence of actions.
Connecting technical and security context
Combined analysis of alerts, logs, metrics, configuration changes and available application telemetry. Checking whether an outage relates to an attack and whether protective action affects service availability.
Prioritisation by business service importance
Linking covered systems to services and their owners. Sequencing actions according to service importance, disruption scope and the identified threat.
Coordinated containment and restoration
Agreeing the timing of isolation, configuration changes and recovery. Verifying restart conditions and providing heightened monitoring after restoration.
Basic vulnerability management
Recurring scanning or assessment of vulnerability data for known, covered assets. Validation, prioritisation, task assignment and verification of remediation, delivered by S&VM.
Configuration reviews and basic hardening recommendations
Assessment of selected security settings and identified deviations. Recommending changes and implementing those within the approved maintenance catalogue.
Recurring basic threat hunting
Scheduled searches based on selected hypotheses using covered data sources. Documenting findings and translating them into detection improvements and remediation.
Recovery readiness oversight
Combining backup checks with agreed representative recovery tests and technical dependency reviews. Cooperation with the customer or BaaS/DRaaS provider, including SecureVault.
Integration with customer processes
Agreeing shared ticketing, action approvals, escalation and change workflows. Using standard integrations with the customer’s ticketing system and asset inventory.
Unified reporting and management reviews
A combined report on security, availability, vulnerabilities and action delivery. Quarterly reviews of priorities and technical and organisational recommendations with relevant specialists.
Operational audit support and improvement
Organising service-delivery evidence, reports and operational procedures. Maintaining a shared improvement plan informed by incidents, tests, vulnerabilities and reviews.
Working together
Clear scope. Agreed actions.
Responsibilities are documented in the service specification, alongside assets, tools, permissions and escalation paths.
- Enterprise combines responsibility for agreed operations. Assets, technologies, permissions and work remain defined in the service specification.
- Basic vulnerability management covers known assets on an agreed schedule. Discovering unknown internet-facing assets, penetration testing and extensive architecture assessments are extensions.
- Basic hunting has an agreed cycle, hypotheses and data sources. Additional research campaigns require separate agreement.
- Representative recovery tests specify systems, data, the environment and success criteria. Backup storage, replacement infrastructure and BaaS/DRaaS licences are not automatically included.
- Management reviews and service-delivery evidence do not replace vCISO, vISM or DPO roles, ISMS implementation or organisational compliance audits.
We define the SLA for starting work separately from incident containment and service restoration time. 24/7 operation does not guarantee availability of customer systems.
Service onboarding
Before we begin handling events.
We agree the scope
We inventory assets, data sources, service owners, contacts and expected outcomes.
We connect and configure
We activate standard integrations, access, alerts and procedures appropriate to the selected plan.
We verify readiness
We test telemetry, escalation and approved actions, and agree acceptance criteria and the start of operations.
Standard implementation is part of onboarding and may carry a separate setup fee. Dedicated connectors or application code changes are agreed as separate work.
Choose a plan
Frequently asked questions
Does Enterprise include the full NOC and SOC scope?
Yes. Enterprise includes the complete agreed scope of both plans, with shared incident coordination, reporting and priorities. We agree assets and responsibilities so protective actions and service restoration form one process.
What is included in basic vulnerability management and hunting?
Vulnerability management includes recurring assessment of known assets, validation and prioritisation, task assignment and verification of remediation. Hunting covers scheduled hypotheses and in-scope sources. The schedule and size of both scopes are recorded in the service specification.
How often do you perform hunting and recovery tests?
We agree frequency based on risk, service criticality and available testing conditions. A quarterly cycle is a starting point for agreement, not an automatic guarantee for every deployment. Each test has approved scope and success criteria.
Related expertise
Connect activities that complement each other.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.