Client requires a cybersecurity operations center, is this mandatory for a 20-person company?

Don't just check the «No» box on the vendor questionnaire. Put a preliminary agreement in place with an external managed security provider and fill out the form stating «Monitored 24/7 via third-party managed SOC infrastructure», otherwise your submission will be disqualified outright.

edit: typed from phone, sorry for typos.

We bid on a similar public tender with a 22-person team. Building it internally would have cost us at least 400,000 SAR a year in payroll alone. We outsourced the SOC service instead; we pay about 4,800 SAR a month for 8 servers and 25 endpoints, and we passed the client audit without any issues.

Make sure that the outsourced operations center you choose stores all logs within the borders of Saudi Arabia. Under national data protection frameworks, transferring security logs outside the country can result in administrative penalties for vendors serving critical sectors.

Big enterprises send these vendor questionnaires out as standard templates to everyone. Most of the time they already know a small software shop can't afford that. If you sit down with them and explain that your API endpoints are monitored and you provide guaranteed log retention, they might ease up on the requirement.

anyone telling a 20-person company to set up an in-house soc has no clue about the market. you'd go broke just hiring three shifts of analysts. just get a shared tier from an mssp and show the contract to the client you'll be fine.

edit: I wrote something wrong above, sorry about that.

When evaluating quotes from external providers, check these three parameters: 1) Initial incident response SLA for critical security alerts (should be 15-30 minutes), 2) Log retention of at least 12 months, 3) Monthly incident reporting format that you can present to your client during audits.

Does the client's RFP explicitly reference NCA Essential Cybersecurity Controls (ECC) or Critical Systems Cybersecurity Controls (CCC)? If so, which compliance tier is being requested?

we just enabled security alerts and email notifications on our cloud provider, does that setup aolne not count as satisfying the operations center requirement?

You're right. Don't rely on a single measure; go layer by layer.

Payment information changes are never verified through the channel they came from. Good luck with that.

I'll argue the opposite, don't get mad... An automated scan report is not the same as a penetration test.

Payment information changes are never verified through the channel they came from. This is my opinion Im not claiming its absolute truth.

let me summarize whats been said so far... honestly processes without records never improve, because you dont know what to fix.

having backups accessible on the same network and with the same identity makes them part of the targt then btw correct me if I'm wrong.

Let me summarize what's been said so far. Start with a small trial; don't commit to everything at once.

Good luck with that.

You're right, I've been down that road too. Just because everyone does it doesn't mean it's right.

Taking notes for two weeks yields better results than a six-month estimate.

The opposite happened to me, that's why I'm writing. The real issue isn't the number, but what it's based on.

Proven by experience.

Absolutely. If I were to add anything: Just because everyone does it doesn't mean it's right.

Just leaving this note, it might be useful.

I feel the same way. An untested backup is not a backup.

Hope this helps.

Exactly like that. If you don't write this down from the start, it leads to arguments later.

Proven by experience.

let's separate the concepts they're geting mixed up. forgotten test environments are more often the entry point than live systems.