SOC Maturity Calculator
Score SOC maturity across business alignment, people, process, technology and services on a five-level capability scale.
Inputs
Overall Maturity
2.85/ 5
Maturity as a Percentage
57.0%
Maturity Level
Level 3 — Defined
Gap to Target
1.15levels
Weakest Domain
Services — the catalogue is narrower than the mandate
Recommended Next Step
Lift the weakest domain to level 3 first; balanced capability beats one strong pillar
Step by step
Values used
Business alignment — charter, sponsorship, reporting = 3 — Defined charter with regular reporting; People — staffing, skills, training, retention = 3 — Career paths and a training plan; Process — playbooks, escalation, quality assurance = 3 — Documented and followed; Technology — SIEM, EDR, SOAR, coverage and tuning = 3 — Integrated stack with broad coverage; Services — monitoring, IR, hunting, intel, forensics = 2 — Monitoring plus basic incident response; Target maturity level = 4 level
SOC Maturity
Maturity = 0.25 × process + 0.25 × technology + 0.2 × people + 0.15 × business alignment + 0.15 × services, each scored 1–5.
Gap to target
Gap to target = target level − current score, floored at zero.
Overall Maturity
= 2.85 / 5
Maturity as a Percentage
= 57.0
Maturity Level
= Level 3 — Defined
Gap to Target
= 1.15 levels
Weakest Domain
= Services — the catalogue is narrower than the mandate
Recommended Next Step
= Lift the weakest domain to level 3 first; balanced capability beats one strong pillar
How it works
Process and technology carry the heaviest weights because they are what make capability survive staff turnover — an undocumented SOC loses its capability with its best analyst. The weakest-domain output exists because maturity is limited by its worst pillar rather than its average. Maturity assessments are how SOC investment gets prioritised and how regulators and customers judge the function, and a balanced level 3 delivers more than a lopsided level 4 with no documented process.
Formulas
SOC Maturity
Maturity = 0.25 × process + 0.25 × technology + 0.2 × people + 0.15 × business alignment + 0.15 × services, each scored 1–5.
- process
- Playbooks, escalation and quality assurance
- technology
- Tooling coverage, integration and tuning
- people
- Staffing, skills, training and retention
- services
- Breadth of the service catalogue
Gap to target
Gap to target = target level − current score, floored at zero.
- target level
- The maturity level your charter or regulator expects
Frequently Asked Questions
How is SOC Maturity calculated?
Maturity = 0.25 × process + 0.25 × technology + 0.2 × people + 0.15 × business alignment + 0.15 × services, each scored 1–5. Process and technology carry the heaviest weights because they are what make capability survive staff turnover — an undocumented SOC loses its capability with its best analyst. The weakest-domain output exists because maturity is limited by its worst pillar rather than its average.
Why does SOC Maturity matter?
Maturity assessments are how SOC investment gets prioritised and how regulators and customers judge the function, and a balanced level 3 delivers more than a lopsided level 4 with no documented process.
What values do I need to enter?
This calculator takes 6 inputs: Business alignment — charter, sponsorship, reporting, People — staffing, skills, training, retention, Process — playbooks, escalation, quality assurance, Technology — SIEM, EDR, SOAR, coverage and tuning, Services — monitoring, IR, hunting, intel, forensics, Target maturity level. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Is level 5 the goal?
For most organisations, no. Level 4 — measured and managed — is the sensible destination; level 5 requires continuous optimisation effort that only pays back where security operations are core to the product. Aim for balance across domains before height in any one.
How often should this be reassessed?
Annually as a formal exercise, with a lightweight quarterly check on the domain you are actively investing in. More frequent full assessments generate noise rather than insight, since maturity moves slowly by design.