What does SOC stand for?
SOC stands for Security Operations Center. Security operations center: the team, and often the facility, that monitors, detects and responds to security events. (SOC 2 is a separate audit report.)
A SOC is the team, with its processes and tools, that watches an organization's systems for security incidents and responds to them. Analysts are often organized in tiers: the first triages alerts, the second investigates, the third hunts for threats and handles the hardest cases. A SOC can be in-house, outsourced to a provider, or a mix of the two.
SOC in practice: an example
An alert about an impossible-travel sign-in reaches a tier 1 analyst, who confirms it is not a VPN artefact and escalates. Tier 2 finds a mailbox rule created by the attacker, resets the account and documents the incident. The SOC lead reviews the case and tunes the detection.
What SOC is confused with
SOC vs NOC: what is the difference?
A network operations center keeps services available and fast. A SOC looks for attackers. The same outage is a performance question for the NOC and a possible denial-of-service attack for the SOC.
SOC vs SIEM: what is the difference?
The SIEM is a tool. The SOC is the people and processes that use it. What SIEM stands for
Which exams cover SOC?
SOC is on the official CompTIA acronym list for one of the four exams covered here.
- Security+ SY0-801: on the acronym list, not tied to one objective.
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A link is saturated at 14:00. Which team asks first whether the traffic is malicious?
- The SOC
- The help desk
- Procurement
- The NOC only, since it is a network issue
Show the answer
A. The SOC. Availability belongs to the NOC, but deciding whether activity is an attack is the SOC's job. In practice the two teams work the event together.
2. What is the usual role of a tier 1 SOC analyst?
- Writing company security policy
- Triaging alerts and escalating real incidents
- Approving the security budget
- Designing the network
Show the answer
B. Triaging alerts and escalating real incidents. Tier 1 is the first look at each alert: dismiss false positives, gather basic context, escalate the rest.
Sources: NIST glossary: security operations center; NIST SP 800-61 Rev. 3, Incident Response Recommendations. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.