Size a SOC rota in FTE, including the 4.2–5 FTE per seat that genuine 24×7 coverage requires once shrinkage is funded.
168 ÷ 40 is 4.2, which is why a single 24×7 seat needs at least 4.2 FTE before anyone takes a day off. Dividing by (1 − shrinkage) funds leave, sickness and training, which pushes a realistic seat to about 5.25 FTE — the number most SOC business cases are missing. Under-funded rotas fail predictably: the fifth person is cut in budget review, then every holiday is covered by overtime until people leave, and the vacancy makes the coverage gap permanent.
SOC Staffing
FTE per seat = coverage hours per week ÷ contracted hours per FTE ÷ (1 − shrinkage). Total FTE = seats × FTE per seat, plus tier 2 and leadership.
Leadership and cost
Team leads = (tier 1 + tier 2 FTE) ÷ span of control; annual cost = total FTE × fully loaded cost per FTE.
FTE per seat = coverage hours per week ÷ contracted hours per FTE ÷ (1 − shrinkage). Total FTE = seats × FTE per seat, plus tier 2 and leadership. 168 ÷ 40 is 4.2, which is why a single 24×7 seat needs at least 4.2 FTE before anyone takes a day off. Dividing by (1 − shrinkage) funds leave, sickness and training, which pushes a realistic seat to about 5.25 FTE — the number most SOC business cases are missing.
Under-funded rotas fail predictably: the fifth person is cut in budget review, then every holiday is covered by overtime until people leave, and the vacancy makes the coverage gap permanent.
This calculator takes 7 inputs: Seats to staff concurrently, Coverage model, Contracted hours per FTE per week, Shrinkage — leave, sickness, training, attrition, Tier 2 analysts per tier 1 analyst, Analysts per team lead, Fully loaded cost per FTE. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
A week has 168 hours and a full-time analyst works about 40, so covering one chair around the clock takes 4.2 people even if nobody is ever ill or on leave. Any rota built on four is quietly relying on overtime.
Often, yes — and that is usually the honest comparison. Outsourcing nights and weekends buys the expensive part of the coverage curve, but only works if the provider has authority to contain, not just to notify.