A vendor will say: “without a SOC you are naked”. Sometimes that is true for a large organisation with a roster and processes. For a small firm the truth is more often: close the basics first, then think about monitoring.
A SOC (monitoring centre) without order in accounts and mail is a camera on a door with no lock. You will get alerts and someone will still walk in through an old panel or a mailbox without MFA.
What this text does not sell
It does not sell a “full SOC” subscription. It does not promise that after a week “you will be 9/10 secure”. It describes an order you can do without a 24/7 roster.
Order 1–2–3 (before monitoring)
1. Accounts and who holds the key
- list of people with access to mail, drives, panels,
- leavers: accounts disabled, not “left on holiday”,
- MFA where it can be turned on without chaos — even the passkey / MFA checklist.
Without that every SOC alert is late: someone already has the password or the session.
2. Email and payments
- forwarding rules in mailboxes,
- a second channel when the bank account number changes (bank-detail change verification),
- clear: who may send an invoice from the company mailbox.
Many SME losses are not slide-deck ransomware — they are a transfer after mail from a taken-over mailbox.
3. Exposure and backup
- what faces the internet: old sites, RDP, panels — what the internet can see and the exposure worksheet,
- a copy that ransomware / a malicious admin cannot delete with one account,
- one test: can you restore something important (not “we have cloud backup”).
Only when those three blocks do not hurt under an honest answer does a SIEM / SOC conversation make sense. Otherwise you pay for noise.
A ready seven-day plan
If you want a day-by-day checklist without buying a tool: Close-the-basics week. Free product on the site — not a retainer.
When monitoring does make sense
When you already have MFA, access hygiene, known exposure, a tested copy and someone who reads alerts in a sensible time. Then the tool has something to hang on. Before that — order.
Not sure which block to start with? Where to start or a scope quote. Form usually 1 business day; phone temporarily unavailable. This is not a SOC roster.