People in the SOC: maturity and retention
How to assess the SOC-CMM People domain with evidence for roles, retention, stress, skills, training and operational dependency from the 2026 report.
The challenge is not only hiring
The 2026 report places staffing, retention and workload management among SOC operational challenges. Most organizations can recruit analysts within six months, but retention is concentrated in the 2-3 year range and regional differences exist. People maturity is not measured only by analyst count, but by structure, knowledge, training, dependency and sustainability.
Evidence to request for People
SOC-CMM reviews roles and hierarchy, people management, knowledge management and training and education. Evidence should show that the SOC does not depend on informal knowledge or specific individuals to sustain service delivery.
| Aspect | Reviewable evidence | Immaturity signal |
|---|---|---|
| Roles and hierarchy | RACI, shifts, levels, handovers and escalations. | Ambiguous responsibilities or hero dependency. |
| People management | Capacity plan, sourcing, retention and coverage. | Reactive hiring without retention strategy. |
| Knowledge | Knowledge base, post-mortems, guides and ownership. | Tribal knowledge is not documented. |
| Training | Skills matrix, training plan and capability evolution. | Isolated courses not tied to operational gaps. |
Operational stress as a maturity indicator
The report identifies high workload, false positives and insufficient management support as leading causes of SOC stress. This connects People with Process and Technology: if alert queues, detection quality and reporting are not governed, the problem appears as burnout even when the root cause is systemic.
People roadmap 30/90/180
A People roadmap should reduce dependency and noise before expanding the structure. First clarify roles and workload; then correct knowledge, training and handover; finally connect staffing with automation, metrics and continuous improvement.
- Measure real workload by shift and activity type.
- Separate capacity problems from noise problems.
- Document critical knowledge and escalation criteria.
- Define skills by role, not by generic course.
- Align sourcing and retention with the SOC operating model.
Real shift capacity
Total headcount hides fragility. Capacity should be read by shift, role, language, service, escalation level and response window. A SOC may look staffed and still be exposed during nights, weekends, vacations or due to dependence on a single engineer for critical rules.
| Dimension | Evidence | Risk signal |
|---|---|---|
| Shifts | Calendar, on-call, handovers and real coverage. | Gaps covered by informal overwork. |
| Skills | Matrix by role and critical activity. | Only one person can maintain a source or playbook. |
| Escalation | L1/L2/L3 criteria and target times. | Escalations based on personal availability. |
| Retention | Turnover, tenure and succession plan. | Knowledge loss every 2-3 years. |
Frequently asked questions
Independent by design
Primedefence assesses against the SOC-CMM and nothing else. The model is free, open and cited by MITRE, the NCSC and ENISA. The assessment is delivered by an external third party with no stake in the result and no SOC operation of its own, so the finding answers to your interest alone.
