A SOC maturity assessment NCA ECC engagement examines whether your security operations can detect the threats the National Cyber Security Authority expects you to monitor, whether your analysts follow documented procedures when they do, and whether the technology stack you have deployed can close the gaps you face. For CISOs and IT security managers at SAMA-regulated institutions, the question is not whether you operate a SOC—most do, in-house or outsourced—but whether that SOC will demonstrate adequate capability when the NCA evaluates your compliance with the Essential Cybersecurity Controls framework, particularly the detection and response requirements under Domain 4-1.
This article explains how we deliver a SOC maturity assessment that maps your current detection and response capabilities to NCA ECC expectations. You will understand what happens in each of the five phases, which artifacts we examine, who participates from your side, and the format of the deliverables you receive at the end.
Why NCA ECC Domain 4-1 Demands More Than Log Collection
The NCA ECC framework requires regulated entities to implement controls for the detection of cybersecurity events and incidents. Domain 4-1 sets out expectations for continuous monitoring, log management, correlation of security events, and timely detection of anomalies and known attack patterns. The Authority publishes a threat catalogue that describes the techniques and tactics you are expected to monitor; your SOC's use cases—the detection rules, correlation searches and behavioural analytics you have configured—must address that catalogue in a way that is appropriate to your risk profile.
Many institutions collect logs from endpoints, firewalls, proxies and directory services, and they route those logs to a SIEM or log-management platform. But collection is not detection. The NCA expects you to have use cases that turn raw events into actionable alerts, playbooks that guide analysts through triage and escalation, and metrics that prove you detect and respond within reasonable time windows. When we assess SOC maturity, we test all three layers: the technology that ingests and correlates, the processes that govern response, and the people who execute them.
Our Five-Phase SOC Maturity Assessment Method
We assess your security operations across people, process, technology, detection coverage and response, and give you a prioritized improvement plan. The engagement typically runs three to five weeks, depending on the size of your SOC, the number of log sources, and whether the operation is in-house, outsourced, or hybrid.
Phase One: Scoping and Stakeholder Interviews
The assessment opens with structured interviews. We meet your SOC team, the manager or lead responsible for security operations, and—if you use an outsourced or co-managed provider—the provider's account and technical leads. The purpose is to understand your operating model: who monitors which hours, who escalates to whom, which technologies you own versus which the provider operates, and how incidents move from L1 triage to L2 investigation to formal incident response.
We also review any existing service-level agreements, statements of work, or operating-level agreements that define detection and response expectations. If your provider commits to a mean time to detect or mean time to respond, we note those commitments so we can test them later.
What you provide: Organizational chart for the SOC or security team, any SLA or SOW with your provider, and contact details for the analysts and engineers we will interview.
What you hold at the end of this phase: A shared understanding of scope and a calendar of interviews and technical sessions for the remaining phases.
Phase Two: Log Source and Detection Coverage Mapping
In this phase we inventory every log source feeding your SIEM or central logging platform, and we map the detection use cases you have enabled against the techniques in the NCA threat catalogue and common attack frameworks. We examine which data sources are parsed and normalized, which are stored but not actively monitored, and which expected sources are missing entirely.
For each use case—whether it is a correlation rule, a scheduled search, a machine-learning model, or a threat-intelligence match—we document:
- The technique or threat it is designed to detect.
- The log sources and fields it consumes.
- The alert severity and the expected triage action.
- Whether it is enabled in production or still in tuning.
We then overlay this inventory onto the NCA ECC threat catalogue to produce a detection coverage map that shows which required techniques you monitor, which you monitor partially, and which you do not monitor at all. This map becomes the foundation of your capability heatmap.
What you provide: Access to your SIEM or logging platform (read-only is sufficient), export of enabled correlation rules and alerts, and any internal documentation that describes your use-case library.
What you hold at the end of this phase: A complete inventory of log sources and use cases, and a preliminary coverage map that highlights gaps against NCA expectations.
Phase Three: Playbook and Alert Quality Review
Detection is only the first step; response depends on documented procedures and analyst discipline. In this phase we review the playbooks that guide your analysts when an alert fires. We select a representative sample of high-priority and medium-priority alerts from the past 90 days, and for each we trace:
- How quickly the alert was acknowledged.
- Which investigation steps the analyst performed.
- Whether the analyst followed a documented playbook or relied on informal knowledge.
- Whether the alert was escalated, closed as a false positive, or left open without resolution.
We also assess alert quality: the ratio of actionable alerts to noise, the consistency of triage notes, and whether tuning efforts are tracked and prioritized. High false-positive rates and vague triage notes are symptoms of immature processes; they also make it difficult to demonstrate compliance during an NCA inspection.
What you provide: Sample alerts and tickets from your SIEM or ticketing system, copies of playbooks (whether they are wiki pages, PDFs, or embedded in a SOAR platform), and access to any case-management or workflow tool your analysts use.
What you hold at the end of this phase: An alert quality summary and a playbook maturity score, with specific recommendations for which procedures to document or revise.
Phase Four: Mean-Time Metrics and Escalation Path Testing
The NCA expects you to detect and respond to incidents in a timely manner. In this phase we calculate your actual mean time to detect and mean time to respond for the sample of alerts reviewed in Phase Three, and we compare those figures to any SLA commitments and to reasonable industry benchmarks for your sector.
We also test your escalation paths. We walk through a hypothetical incident—such as a suspected ransomware deployment or an insider exfiltrating sensitive data—and we ask your team to describe, step by step, who would be notified, which internal stakeholders would be briefed, and at what point you would invoke your formal incident-response plan. This exercise often reveals gaps: unclear ownership, missing contact details, or confusion about when an event becomes an incident.
What you provide: Historical alert and ticket data (anonymized if necessary), and participation from the SOC manager and any on-call incident responders in the escalation walk-through.
What you hold at the end of this phase: Measured mean-time metrics, a tested escalation matrix, and a clear picture of where delays or confusion occur.
Phase Five: Technology-Gap Analysis and Prioritized Roadmap
The final phase synthesizes findings from the previous four. We perform a technology-gap analysis that identifies which missing log sources, unmonitored techniques, or absent capabilities (such as endpoint detection and response, network traffic analysis, or user and entity behavior analytics) would most improve your detection coverage. We consider your risk profile, your regulatory obligations under both NCA ECC and the SAMA Cyber Security Framework, and the practical constraints of budget and staffing.
We then prepare a prioritized roadmap that sequences improvements across three horizons: immediate actions (such as enabling an existing but dormant use case or documenting a critical playbook), near-term projects (such as onboarding a new log source or tuning high-noise alerts), and strategic initiatives (such as deploying a new technology or redesigning your tiering model).
What you provide: Input on budget cycles, planned technology refreshes, and any strategic priorities (for example, a move to the cloud or a merger that will change your environment).
What you hold at the end of this phase: A complete maturity assessment with scoring, a capability heatmap, and a sequenced improvement backlog.
Deliverables You Receive
At the conclusion of the engagement, you receive four principal deliverables:
- SOC maturity report — A written assessment that scores your SOC across people, process, technology, detection coverage and response. The report includes findings, evidence, and a maturity level (typically expressed on a five-level scale from initial to optimized) for each dimension.
- Detection coverage map — A visual matrix that maps your current use cases to the NCA ECC threat catalogue and highlights which techniques you detect, which you detect partially, and which remain unmonitored. This map is the artifact you will reference during NCA inspections or internal audit reviews.
- Use-case improvement backlog — A prioritized list of detection use cases to create, tune or retire, with sufficient detail that your SOC team or provider can begin implementation immediately.
- Target operating model — A blueprint that describes the people, process and technology configuration you should aim for, including recommended staffing levels, shift patterns, tool capabilities, and integration points with your broader incident-response and threat-intelligence functions.
These deliverables are designed to be actionable. The roadmap includes effort estimates and dependencies so you can integrate improvements into your annual planning cycle, and the coverage map provides the evidence you need to demonstrate progress to your executive committee, your board, or the NCA.
Who Participates From Your Side
A successful SOC maturity assessment requires collaboration. You will need to involve:
- SOC analysts and engineers for interviews, use-case walk-throughs, and playbook reviews.
- The SOC manager or security operations lead for process discussions, SLA reviews, and escalation testing.
- Your SIEM or platform administrator to provide access, export configurations, and explain any custom integrations.
- Your managed-service provider's technical and account leads if you outsource or co-manage SOC functions.
- A sponsor from IT or risk leadership to approve scope, prioritize findings, and champion the roadmap internally.
Most interviews and technical sessions last between one and two hours, and we schedule them to minimize disruption to your 24×7 operations.
How This Assessment Supports NCA ECC Compliance
The NCA ECC framework is explicit: you must implement controls to detect cybersecurity events, you must monitor for the threats relevant to your environment, and you must demonstrate that your monitoring is effective. A SOC maturity assessment mapped to NCA ECC gives you three compliance advantages:
- Evidence of due diligence — The detection coverage map and maturity report show the NCA that you have systematically evaluated your capabilities and identified gaps.
- A clear improvement trajectory — The prioritized roadmap demonstrates that you are not static; you have a plan to close gaps and mature your operations.
- Repeatable metrics — Mean-time figures and alert-quality scores give you a baseline to measure progress year over year, which is exactly what the NCA expects during follow-up inspections.
Many institutions wait until they receive an NCA inspection notice to assess their SOC. By that point, there is little time to remediate findings. Conducting a maturity assessment as part of your annual assurance cycle—alongside internal audits and penetration tests—means you enter any regulatory engagement with confidence and evidence.
Next Steps: Security Operations Maturity Assessment
If you are preparing for an NCA inspection, responding to an internal audit finding, or simply uncertain whether your SOC can detect the threats you face, a structured maturity assessment provides clarity and a roadmap. We assess your security operations—in-house or outsourced—across people, process, technology, detection coverage and response, and give you a prioritized improvement plan.
The engagement runs three to five weeks and produces the four deliverables described above: maturity report, detection coverage map, use-case improvement backlog, and target operating model. To discuss scope and timing, contact our Security Operations practice.
