Having an implemented capability does not necessarily mean being in a position to certify it. A SOC may have been performing vulnerability analyses, monitoring events, or responding to incidents for years and still find aspects that need reviewing when comparing its operations with the established certification requirements. The difference lies in what can be demonstrated.

The CCN-STIC 896 Guide, Specific Compliance Profile for Managed Security Services (PCE-SSG), establishes the minimum mandatory requirements to accredit the technical competence and operational capacity of services seeking certification. It addresses not only what the SOC does, but also how that work is organized, what procedures support it, what tools are used, what roles are involved, and what evidence the activity leaves.

Therefore, reading the guide focusing solely on technology provides an incomplete view. A significant portion of the requirements relate to how a capability becomes an organized, repeatable, and accreditable service.

Beyond Technical Capacity

The section dedicated to operational requirements allows us to see how far the CCN-STIC 896 standard goes into practical application.

Let's take vulnerability analysis, included within Prevention Services, as an example. The guide doesn't just require that the SOC be able to identify vulnerabilities. Among other requirements, it establishes that there must be a defined procedure for their identification, analysis, reporting, and follow-up until it is verified that they have been corrected; that the documentation of these processes must be kept up to date; that an updated inventory of assets must be available; and that the identified vulnerabilities must have a criticality assessment system based on references such as CVE or CVSS.

It also includes monitoring new vulnerabilities that may affect the organization, generating reports and dashboards that facilitate decision-making, and using ticket management tools to notify and track alerts.

This example is useful because it illustrates the logic behind the certification. It is not enough to simply perform a technical activity correctly. It is necessary to demonstrate that a process exists behind it and that this process can be sustained over time.

This same logic, with specific requirements, applies to the various services and sub-services covered by the guide.

In practice, this forces us to look at daily operations with a different perspective. A task can be performed efficiently and yet depend too heavily on the experience of a specific individual. A procedure may exist, but it may not have been updated for months. Relevant information may be generated during an investigation but not stored in a way that allows for later reconstruction of what happened.

It is precisely these discrepancies between technical capability and its formalization that should be identified before undertaking an audit.

A Practical Way to Review a Service

Instead of starting with all available documentation, it can be more useful to select one of the services you intend to certify and follow its operation from beginning to end.

For example, regarding an actual service activity:

• Is there a procedure that describes how it should be carried out?
• Does the documentation reflect how work is currently done?
• Can you identify who was involved and what actions they took?
• Are relevant decisions and results recorded?
• Are the planned monitoring tools and mechanisms being used?
• Can evidence of what was done be retrieved later?
• Does the staff carrying out the activity have the required training?

If any of these questions are difficult to answer, it is worth reviewing that point before moving on to the next. process.

Not all of these will be applicable in the same way to all services. CCN-STIC 896 itself establishes specific requirements for each one. The usefulness of the exercise lies in verifying whether there is continuity between what the procedure establishes, what happens during service delivery, and what can ultimately be documented. This is often one of the keys to preparation.

The guide also pays special attention to the professionals involved in the SSG (Service Management Systems). It highlights the importance of operators and analysts having standardized operating procedures and up-to-date documentation on use cases and established protocols, with the aim of reducing improvisation. It also includes professional profiles associated with the different services and guidelines regarding their training and experience.

This introduces another issue that is not always considered when discussing certification: the SOC's capability must be maintained, even if the people performing a given task change.

If a process only works because an analyst knows how to solve it by heart, technical knowledge exists, but operational maturity may still be lacking. Documenting, standardizing, and preserving evidence allows that individual knowledge to be transformed into a service capability.

Preparing for CCN-STIC 896 can serve precisely to identify these points. More than accumulating documentation for the audit, it's about verifying that there is a correspondence between people, processes, technology, and evidence.

A simple test consists of choosing a recent activity and trying to reconstruct it using only the information held by the SOC. If it's possible to know what happened, what procedure was followed, who was involved, what decisions were made, and what the result was, a good foundation is likely in place. If we have to rely on the memories of those who participated to complete the story, we already have a clue as to where the next improvement might be.