SOC readiness and coverage checklist
To audit your detection and response, whether your SOC is in-house, external or mixed
SOC & Detección
SOC readiness and coverage checklist
A list to audit detection and response capability with evidence: governance and scope, telemetry sources, time windows, detection, triage and response, notification and compliance, and improvement and reporting. Each item is marked Yes, Partial, No or Not applicable, with its evidence; a Yes without evidence counts as Partial. It works for in-house, external or mixed SOCs.
Contents / Contenido
- 1. Governance and scopePreview
- 2. Telemetry sourcesPreview
- 3. Time windowsRequires download
- 4. DetectionRequires download
- 5. Triage and responseRequires download
- 6. Notification and complianceRequires download
- 7. Improvement and reportingRequires download
- How to read the resultRequires download
- SourcesRequires download
Preview: first pages
A list to audit detection and response capability with evidence: governance and scope, telemetry sources, time windows, detection, triage and response, notification and compliance, and improvement and reporting. Each item is marked Yes, Partial, No or Not applicable, with its evidence; a Yes without evidence counts as Partial. It works for in-house, external or mixed SOCs.
The preview of this whitepaper includes the executive summary, regulatory context and methodological approach that frames the rest of the document. Download to access full templates, matrices and checklists.
- 1. Governance and scope
- 2. Telemetry sources
Gorka Gonzalo
Founder & CEO
Founded Hodeitek in 2023 and runs the company, after more than 8 years in pentesting, Red Team, OT/ICS auditing, and SOC leadership. A cybersecurity and AI expert, he sets the technical and product direction of HodeiShield and personally leads the most critical engagements — from defense strategy to applying AI in threat detection. He is the client's direct point of contact: whoever scopes the work also answers for the result.
Related resources
Guide: reducing alert fatigue in a security team
A five-step method to give a security team its hours back: a baseline before changing anything, an owner for every rule, noise reduction at the source, correlation and context-based prioritisation. It explains where AI helps and where it does not, and closes with an improvement loop and a checklist. It includes no savings figures: every improvement is measured in your own environment.
OT cybersecurity for plant management: a 25-question self-assessment and a 12-month roadmap
A guide for whoever is accountable for keeping the line running: plant management, maintenance and process engineering. It includes a 25-question self-assessment in five blocks (inventory, network and segmentation, access, detection and response, recovery and suppliers), a 12-month roadmap ordered by risk of downtime, a short explanation of what IEC 62443 and NIS2 ask for, and the facts on the SPRI Industrial Cybersecurity 2026 grant, subject to the rules of the call. October 2026 edition, version 1.0.
Bull-Eye: custom-built platform for Bullhost. Combines AI and SOAR on sovereign European infrastructure, reduces MTTD from 45 minutes to under 10 seconds, and is owned and operated by Bullhost.
Bull-Eye: custom-built platform for Bullhost. Combines AI and SOAR on sovereign European infrastructure, reduces MTTD from 45 minutes to under 10 seconds, and is owned and operated by Bullhost.