SOC-Lite FAQ: Plain Answers Before You Book

What SOC-Lite is #

What is SOC-Lite?

We check your alerts, call you when one is real, guide your team through the fix, and document it. Your endpoint and email tools raise alerts all day. We work out which ones are real before anyone’s day is interrupted, and the call comes from a person you have met, in plain English: what happened, what it touches, and what to do first.

Who is it for, and when is the right time?

It is for Central Florida businesses of 10 to 200 people, and the right time is when one of four situations applies. Those are a cyber-insurance renewal in the next 90 days, a customer’s security questionnaire holding up a deal, card-payment requirements, or recovering from a breach in the last 12 months.

Do you replace an IT person or MSP?

No, we work alongside them and do not replace them. An MSP is a managed service provider, an outside firm that runs your IT. They keep the keys, meaning they stay in control of your systems, and we give them clear steps, one at a time, with someone on the line while they work.

What if a business has no IT person or MSP?

You will also want one you trust. SOC-Lite works alongside that person or firm, so it is not a substitute for having one.

Hours and emergencies #

When do you work?

Our business hours are weekdays, 8 a.m. to 5 p.m. Eastern, except US federal holidays. We are not watching outside those hours, and we would rather say so up front than let you assume otherwise.

What happens outside business hours?

Automated critical alerts go straight to your named contacts, and we follow up at 8 a.m. on the next weekday that is not a federal holiday. Holidays work the same way as evenings and weekends. High-priority alerts that arrive then are queued for the next coverage window, unless automation or an endpoint-protection partner’s own policy escalates them. Before we start, we name your business and technical contacts and run one test alert end to end, so the right people are already on the list.

What if it is a real emergency at 2 a.m.?

A pre-arranged incident-response partner is available under separate terms. Their number and the plan are on your contact sheet before you ever need them, so nobody is hunting for a phone number in the middle of a crisis.

How fast do you respond during business hours?

Critical alerts get a call from us right away, and high-priority alerts are acknowledged within four business hours. We do not promise any other time.

What you get #

What happens when we find something?

During business hours, a critical alert gets an immediate analyst call, guidance and a written escalation. A high-priority alert is acknowledged within four business hours and you are advised. Every case record notes what was detected and when, what we did, when you were told, and what your owner decided, and it ends closed, kept under watch, or escalated, with a reason. The full walkthrough is in What Happens When We Find Something.

What is in the monthly evidence file?

One short document with three parts: “Coverage”, “Alerts and cases” and “Decisions”. “Coverage” shows which data sources we expected and which were healthy, including any gaps. “Alerts and cases” lists alerts by severity, cases opened, how fast each was acknowledged, and what is still open. “Decisions” lists top risks, changes made and next actions, each with an owner and a due date. Owners send it with a cyber-insurance renewal, attach it to a stalled customer questionnaire, or keep it as a record of decisions, including ones they chose to put off. For how to use it at renewal, see What Goes in a Monthly Evidence File, and How to Use It at Insurance Renewal.

What happens at the visibility check?

It is free, it takes 20 minutes, and it is by phone or at your office. You leave with a short written summary whether or not SOC-Lite is a fit, so the call is useful even if you decide not to go further.

What we do not do #

Does the evidence file prove a business meets a compliance requirement?

No, it is not a compliance certificate. It records real monitoring and real response. Each business stays responsible for its own compliance program and its own relationship with its broker, carrier or assessor.

Will an insurer or customer accept it?

Your broker, carrier or customer decides, not us. We do not promise insurer acceptance, a lower premium or an approved renewal, so ask them what they need to see.

Do you prevent attacks?

We do not promise prevention. What we do is check alerts, call you when one is real, guide your team and keep the record.

Do you do forensics, legal advice or regulatory notices?

No, none of those are part of the service. That covers digital forensics, breach counsel and regulatory notices. For a real emergency, the route is the pre-arranged incident-response partner, under separate terms.

Who fixes the problem?

Your IT person or MSP carries it out; we advise and document, unless a written agreement says otherwise. The agreement states who may isolate a device, disable an account, contact law enforcement, notify an insurer or engage breach counsel. A notification or guidance from us is not a fix, and we say that plainly.

Book a visibility check #

Have a question that is not here? Ask us at the visibility check.

At SOC-Lite, a named analyst reviews your alerts, calls you when one is real, works with your IT person or MSP on the fix, and keeps the evidence. A visibility check is free, it takes 20 minutes, and you talk to us by phone or at your office. Book a visibility check