SOC Maturity Assessment
A quick, educational maturity self-assessment for your security operations centre, structured around the open SOC-CMM (Security Operations Center Capability Maturity Model). Work through a weighted checklist across the five SOC-CMM domains — Business, People, Process, Technology and Services — and get a banded 0–100 maturity score mapped to a CMM level (Initial → Managed → Defined → Quantified → Optimizing), a radar of where you are strong and weak, and the gaps ranked so you improve the domains that move the needle most first. The weighting is a transparent heuristic, nothing is uploaded, and the result is shareable by permalink. This is not the official SOC-CMM tool.
The SOC runs on ad-hoc effort and individual heroics. Mandate, staffing, documented process and defined services are mostly missing, so outcomes depend on who is on shift. Start with a charter, log-source coverage and a documented triage process — the foundations everything else builds on.
Maturity per domain (0–100)
Prioritised gaps
Highest-weight, lowest-scoring domains first — spend improvement effort here.
- Services · unanswered
Formalise security monitoring as a service with defined coverage, triage SLAs and ownership, so it is dependable rather than best-effort.
Reference: SOC-CMM: Services
- Services · unanswered
Make incident response an explicit service with a tested process — whether in-house or a rehearsed handoff — so response is not invented during the incident.
- Process · unanswered
Document the core workflows (triage, investigation, escalation, handover) as runbooks so delivery is repeatable, not personality-dependent.
Reference: SOC-CMM: Process
- Process · unanswered
Run detections through a lifecycle (propose → build → test → tune → retire) with ownership, so the detection set stays intentional and current.
- Process · unanswered
Define incident severities, escalation thresholds and the handoff to IR, so a real incident follows a path instead of being improvised.
- People · unanswered
Map coverage to the hours you claim to monitor; if 24/7 is promised but nights are thin, close the gap with staffing, follow-the-sun or a managed partner.
- People · unanswered
Build a skills matrix and a training plan; track each analyst against it so capability gaps are visible and planned for, not discovered in an incident.
Reference: SOC-CMM: People
- Technology · unanswered
Inventory your log sources against your estate; document and close coverage gaps so the SOC is not blind to whole swathes of the environment.
Reference: SOC-CMM: Technology
+ 18 more gaps in the full export.
Business · weight 15
The mandate: a SOC exists to serve the organisation. A clear mission, defined scope and customers, sustained funding and governance are what keep it aligned to risk rather than drifting into a tool-watching team.
The SOC has a documented mission / charter and a defined scope of what it is responsible for monitoring and defending.
The SOC's internal customers and stakeholders are identified, and their expectations are captured (e.g. in service-level objectives).
The SOC has a stable, defined budget and funding model rather than being resourced ad hoc.
There is governance and management oversight of the SOC — someone owns it, reviews its performance, and it reports upward on a cadence.
SOC priorities are driven by the organisation's risk profile and threat landscape, not only by the alerts the tools happen to generate.
People · weight 20
Analysts are the SOC. Adequate staffing and coverage, clear roles, a skills baseline with ongoing training and certification, and a career path that retains people are what separate a resilient SOC from one dependent on heroics.
Staffing levels and shift coverage match the SOC's stated hours of operation, so there is no silent gap in monitoring.
Roles and responsibilities (tiers, lead, detection engineering, hunting) are defined, so analysts know their remit and escalation is clear.
There is a skills matrix / competency baseline and a training plan that keeps analysts current with the threat landscape.
Relevant certifications and ongoing professional development are supported and tracked for the team.
There is a retention and career-path plan that reduces single-person dependencies and analyst burnout.
Process · weight 22
Repeatability is maturity. Documented procedures, a detection / use-case lifecycle, incident and escalation management, measured performance and a feedback loop are what make the SOC's output consistent regardless of who is on shift.
Core SOC activities are documented as procedures / runbooks, so outcomes do not depend on which analyst is on shift.
There is a managed use-case / detection lifecycle: detections are proposed, built, tested, tuned and retired deliberately — not left to accrete.
A defined incident-management process exists with severities, escalation thresholds and clear handoff to incident response.
SOC performance is measured with meaningful metrics (e.g. time to detect/respond, false-positive rate, coverage) and reported.
There is a continuous-improvement loop: lessons from incidents and tuning feed back into detections and procedures.
Technology · weight 20
The platform the SOC runs on. Broad and correct log collection, detection-engineering and automation tooling, threat-intelligence integration and asset visibility determine what the SOC can actually see and how fast it can act.
Log and telemetry collection covers the sources that matter (identity, endpoint, network, cloud, SaaS, applications) with known coverage gaps documented.
A SIEM or equivalent analytics platform is in place, maintained, and its content (rules, parsers) is kept current.
Response and enrichment are at least partly automated (SOAR, playbooks, enrichment) so analysts are not doing everything by hand.
Threat intelligence is integrated into detection and triage, not sitting in a feed nobody operationalises.
Asset and identity inventories are available to the SOC so alerts can be enriched with ownership, criticality and context.
Services · weight 23
What the SOC actually delivers. Security monitoring, incident response, threat hunting, threat intelligence, vulnerability management and reporting are the services the business pays for — their breadth and reliability are the clearest read on maturity.
Security monitoring and alerting is delivered as a reliable, defined service — not a best-effort glance at a console.
Incident response is a defined SOC service (or a clear, exercised handoff to a dedicated IR function).
Proactive threat hunting is performed on a cadence, not only reactive alert-chasing.
A threat-intelligence service produces usable, contextualised intel for the organisation rather than raw feeds.
The SOC contributes to vulnerability management — prioritising and tracking exposures it has visibility of.
Reporting and forensics / post-incident analysis are delivered as defined outputs, so stakeholders get consistent, evidenced results.
Heuristic self-assessment, structured around the open SOC-CMM model (Business, People, Process, Technology, Services). This is NOT the official SOC-CMM assessment — the real SOC-CMM scores each element on a 0–5 scale across far more detail than this quick self-reflection covers — and PlayCISO is not affiliated with or endorsed by SOC-CMM. The dimension weights and the CMM-aligned bands are a transparent judgement framework for structured self-reflection, not a measurement, certification or guarantee of outcome. This tool performs no scan and runs entirely in your browser — nothing is uploaded. Your answers are stored only in the shareable link you choose to copy.
What this assessment is
- A free, 100% in-browser SOC maturity self-assessment, structured around the open SOC-CMM model (the Security Operations Center Capability Maturity Model): answer a weighted checklist across its five domains and get a banded 0–100 maturity score.
- Five SOC-CMM domains: Business, People, Process, Technology and Services — the same shape the SOC-CMM uses to assess a security operations centre, weighted so that what the SOC delivers (Services) and how repeatably (Process) count most.
- Your 0–100 score is mapped to a maturity level aligned to CMM (Initial → Managed → Defined → Quantified → Optimizing), with a radar of where you are strong and weak and the gaps ranked highest-weight, lowest-scoring first.
- Every question maps to a concrete next action, so the result is a prioritised improvement plan, not just a number — and the weighting is a transparent heuristic you can adjust.
- This is an educational self-assessment, NOT the official SOC-CMM tool; PlayCISO is not affiliated with or endorsed by SOC-CMM. Nothing is uploaded and no scan runs. Export to Markdown or CSV and share the exact scorecard with a base64url permalink.
A SOC is more than a SIEM and some dashboards
It is easy to confuse owning detection tooling with running a mature SOC. The SOC-CMM makes the difference explicit by looking across five domains: a clear Business mandate that ties the SOC to real risk; People with the coverage, roles and skills to deliver; repeatable Process so outcomes do not depend on who is on shift; the Technology platform that decides what you can see; and the Services the SOC actually delivers — monitoring, incident response, threat hunting, intelligence, vulnerability management and reporting. A SOC that scores well on tooling but poorly on process and services is a common and fragile shape.
The five domains are weighted on purpose — Services and Process carry the most, because what a SOC reliably delivers and how repeatably it delivers it are the clearest signals of maturity, while People and Technology enable them and Business sets the mandate. That weighting is a heuristic, shown openly so you can argue with it and adjust it to your own environment. This is an educational self-assessment inspired by the SOC-CMM's structure, not the official SOC-CMM assessment — which scores each element on a detailed 0–5 scale and is freely available from soc-cmm.com — and it quotes no invented statistics. PlayCISO is not affiliated with or endorsed by SOC-CMM.
Frequently asked questions
What is the SOC-CMM (SOC maturity model)?
The SOC-CMM — Security Operations Center Capability Maturity Model — is a widely-used, open framework (published at soc-cmm.com) for assessing and improving the maturity of a security operations centre. It evaluates a SOC across five domains — Business, People, Process, Technology and Services — scoring maturity (and, for several domains, capability) on a 0–5 scale and producing a profile that shows where to improve. This free tool mirrors that five-domain shape for a quick educational self-assessment; it is not the official SOC-CMM assessment and PlayCISO is not affiliated with or endorsed by SOC-CMM.
What are the five SOC-CMM domains this assessment uses?
Business (the SOC's mandate: mission, scope, customers, funding and governance), People (staffing and coverage, roles, skills, training and retention), Process (documented procedures, the detection/use-case lifecycle, incident management, metrics and continuous improvement), Technology (log collection coverage, the analytics/SIEM platform, automation, threat intel and asset visibility), and Services (what the SOC actually delivers: security monitoring, incident response, threat hunting, threat intelligence, vulnerability management and reporting). Each domain is weighted and scored 0–100, then combined into an overall maturity score.
How do the maturity bands map to CMM levels?
The overall 0–100 score is banded into five levels aligned to the Capability Maturity Model: Initial (ad-hoc, heroics-dependent), Managed (basic but inconsistent), Defined (documented roles, processes and a service catalogue), Quantified (measured with metrics and reliable services), and Optimizing (mature and self-improving). The band is a heuristic read, not a measured CMM level — the official SOC-CMM derives its levels from a much more detailed 0–5 scoring of each element, so treat this as a conversation-starter and a prioritisation aid rather than a certified result.
Is this the official SOC-CMM, and is it a certification?
No. It is an educational self-assessment inspired by the SOC-CMM's five-domain structure — not the official SOC-CMM assessment, not a certification, not an audit, and not a substitute for running the real SOC-CMM (freely available from soc-cmm.com). It performs no scan and touches no system. The weights and bands are a transparent heuristic for structured self-reflection, shown openly so you can adjust them to your environment. PlayCISO is not affiliated with or endorsed by SOC-CMM.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.