A security operations center (SOC) is responsible for protecting an organization against threats. This can be an information security operations center that defends against cyberattacks, or a security operations center more generally, such as a division of a government security agency.
An information security operations center (ISOC) is a dedicated site where enterprise information systems (websites, applications, databases, data centers, servers, networks, desktops and other endpoints) are monitored, assessed, and defended. SOC analysts monitor an organization’s network and investigate any potential security incidents. If a cyberattack is detected, the SOC analysts are responsible for taking any steps necessary to remediate it. A SOC includes people, processes, and technology, with a governance and compliance framework. A SOC may be in a building or facility in a central location from which staff supervises the site using data processing technology. Typically, a SOC is equipped for access monitoring and control of lighting, alarms, and vehicle barriers. A SOC can be either internal or external. In the latter case, the organization outsources the security services, such as monitoring, detection and analysis, from a Managed Security Service Provider (MSSP). This is typical for small organizations which don't have the resources to hire, train, and technically equip cybersecurity analysts.
The National Security Operations Center (NSOC) or Directorate K is the part of the United States National Security Agency responsible for current operations and time-sensitive signals intelligence (SIGINT) reporting for the United States SIGINT System (USSS). It is one of two centers watching; the other being Directorate V or the NTOC which assesses threats.