SOC Maturity Calculator
Score SOC maturity across business alignment, people, process, technology and services on a five-level capability scale.
About SOC Maturity Calculator
Process and technology carry the heaviest weights because they are what make capability survive staff turnover — an undocumented SOC loses its capability with its best analyst. The weakest-domain output exists because maturity is limited by its worst pillar rather than its average. Maturity assessments are how SOC investment gets prioritised and how regulators and customers judge the function, and a balanced level 3 delivers more than a lopsided level 4 with no documented process.
Formulas
SOC Maturity
Maturity = 0.25 × process + 0.25 × technology + 0.2 × people + 0.15 × business alignment + 0.15 × services, each scored 1–5.
- process
- Playbooks, escalation and quality assurance
- technology
- Tooling coverage, integration and tuning
- people
- Staffing, skills, training and retention
- services
- Breadth of the service catalogue
Gap to target
Gap to target = target level − current score, floored at zero.
- target level
- The maturity level your charter or regulator expects
Worked example
With the default values below, SOC Maturity Calculator returns Overall Maturity of 2.85. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Business alignment — charter, sponsorship, reportingone of 1 — Ad hoc, no formal charter, 2 — Charter exists, reporting informal, 3 — Defined charter with regular reporting, 4 — Measured against business risk objectives, 5 — Continuously optimised with the business
- 3 — Defined charter with regular reporting
- People — staffing, skills, training, retentionone of 1 — Individual heroics, 2 — Roles defined, training ad hoc, 3 — Career paths and a training plan, 4 — Skills measured against a competency matrix, 5 — Continuous development with low attrition
- 3 — Career paths and a training plan
- Process — playbooks, escalation, quality assuranceone of 1 — Undocumented, 2 — Some playbooks, inconsistently used, 3 — Documented and followed, 4 — Measured with quality review of closed cases, 5 — Continuously improved from case metrics
- 3 — Documented and followed
- Technology — SIEM, EDR, SOAR, coverage and tuningone of 1 — Point tools, no integration, 2 — SIEM deployed, partial coverage, 3 — Integrated stack with broad coverage, 4 — Instrumented, tuned and measured, 5 — Detection-as-code with automated validation
- 3 — Integrated stack with broad coverage
- Services — monitoring, IR, hunting, intel, forensicsone of 1 — Monitoring only, 2 — Monitoring plus basic incident response, 3 — Adds hunting and threat intelligence, 4 — Full service catalogue with defined SLAs, 5 — Advanced services including adversary emulation
- 2 — Monitoring plus basic incident response
- Target maturity levelaccepts 1–5 level
- 4 level
Results
- Overall Maturity
- 2.85 / 5
- Maturity as a Percentage
- 57.0%
- Maturity Level
- Level 3 — Defined
- Gap to Target
- 1.15 levels
- Weakest Domain
- Services — the catalogue is narrower than the mandate
- Recommended Next Step
- Lift the weakest domain to level 3 first; balanced capability beats one strong pillar
Step by step
- 1Values used
- 2SOC Maturity
- 3Gap to target
- 4Overall Maturity= 2.85 / 5
- 5Maturity as a Percentage= 57.0
- 6Maturity Level= Level 3 — Defined
- 7Gap to Target= 1.15 levels
- 8Weakest Domain= Services — the catalogue is narrower than the mandate
- 9Recommended Next Step= Lift the weakest domain to level 3 first; balanced capability beats one strong pillar
Assumptions and limits
- The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is SOC Maturity calculated?
Maturity = 0.25 × process + 0.25 × technology + 0.2 × people + 0.15 × business alignment + 0.15 × services, each scored 1–5. Process and technology carry the heaviest weights because they are what make capability survive staff turnover — an undocumented SOC loses its capability with its best analyst. The weakest-domain output exists because maturity is limited by its worst pillar rather than its average.
Why does SOC Maturity matter?
Maturity assessments are how SOC investment gets prioritised and how regulators and customers judge the function, and a balanced level 3 delivers more than a lopsided level 4 with no documented process.
What values do I need to enter?
This calculator takes 6 inputs: Business alignment — charter, sponsorship, reporting, People — staffing, skills, training, retention, Process — playbooks, escalation, quality assurance, Technology — SIEM, EDR, SOAR, coverage and tuning, Services — monitoring, IR, hunting, intel, forensics, Target maturity level. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Is level 5 the goal?
For most organisations, no. Level 4 — measured and managed — is the sensible destination; level 5 requires continuous optimisation effort that only pays back where security operations are core to the product. Aim for balance across domains before height in any one.
How often should this be reassessed?
Annually as a formal exercise, with a lightweight quarterly check on the domain you are actively investing in. More frequent full assessments generate noise rather than insight, since maturity moves slowly by design.