Can Primedefence say it is a Silver Support Partner?

Yes. The 2026 SOC-CMM report lists Prime Defence as a Silver Support Partner since November 2023. That claim must remain separate from certification of the client SOC.

Which certification level is appropriate?

It depends on ambition, SOC type, risk and stakeholders. Readiness exists to decide whether to target defined, validated or risk-driven.

What happens if readiness shows certification is premature?

That is a valid outcome. Critical gaps are prioritized, a closure plan is defined and the formal process is postponed until the SOC can defend evidence without overpromising.

SOC-CMM certification readiness

How to prepare a SOC for SOC-CMM certification with evidence, defined, validated and risk-driven levels, and careful claims based on the 2026 report.

Prepare SOC-CMM readiness View certification

Hexagonal glass medallion with an intense royal-blue core and a concentric glass ring

Certification readiness is not certification

The 2026 report confirms that demand for SOC-CMM certification is increasing due to regulatory pressure, customer expectations and differentiation, especially among MSSPs. Readiness means reviewing whether the SOC has enough evidence, scope and maturity before entering a formal process. It does not mean promising that the SOC will be certified.

Three levels, three ambitions

SOC-CMM presents certification levels for different maturity and ambition. In 2026, the report lists 15 certified SOCs: 10 risk-driven, 4 validated and 1 defined. The level choice should depend on SOC type, goals, risks and stakeholder expectations.

Level	Practical reading	Readiness evidence
Defined	Reliable and repeatable service with implemented elements.	Clear scope, defined processes and consistent evidence.
Validated	Quality and correctness are verified.	QA, continuity, validation and reviewable metrics.
Risk-driven	Services aligned with customer or stakeholder risks and threats.	Risk profile, prioritization, reporting and service adaptation.

What to review before starting

Readiness should separate documentation gaps, operating gaps and governance gaps. It should also confirm which model version applies, which services are in scope and which claims can be made to customers, board or audit.

SOC and service scope.
Evidence by domain and aspect.
Maturity and capability targets.
Quality, continuity and validation metrics.
Difference between Silver Support Partner, assessment and SOC certification.

Primedefence role

Primedefence is listed in the 2026 SOC-CMM report as a Silver Support Partner. That status supports precise SOC-CMM readiness conversations, but must not be confused with automatically certifying the client or replacing the formal certification process.

Evidence dossier for certification

Readiness should end with a clear dossier: scope, included services, reviewed domains, sufficient evidence, open gaps, owners and a go/no-go decision. That dossier prevents entering certification with scattered documentation or claims the SOC cannot sustain.

Block	Content	Use
Scope	SOC, services, geographies, third parties and exclusions.	Avoid claims outside perimeter.
Evidence	Samples by domain, date, owner and traceability.	Accelerate review and reduce ambiguity.
Gaps	Deficiencies, criticality and closure plan.	Make the go/no-go decision.
Claims	What can be said to customers, audit and board.	Control commercial and reputational risk.

Frequently asked questions

Independent by design

Primedefence assesses against the SOC-CMM and nothing else. The model is free, open and cited by MITRE, the NCSC and ENISA. The assessment is delivered by an external third party with no stake in the result and no SOC operation of its own, so the finding answers to your interest alone.

Prepare SOC-CMM readiness

Keep reading

SOC governance assessment checklist independent SOC-CMM assessment complete SOC-CMM guide