Delhi NCR · Operating since 2002
Outsourcing your security operations centre means renting the analysts, the platform and the 24×7 roster instead of building them. Done well, it is the only realistic way most Indian organisations reach continuous detection; done carelessly, it is a monthly invoice for alerts nobody investigated.
This page is the decision, not the pitch: what the model actually is (our SOC as a Service page explains the generic term), what SEBI, RBI and CERT-In genuinely allow, the four ways outsourced SOC contracts go wrong, and the questions to put to every provider — including us, on our managed SOC services page.
Terminology first
Three names, one commercial model
In Indian tenders, “outsourced SOC”, “managed SOC” and “SOC as a Service” describe the same thing: a third party runs the detection and investigation function — the analysts, the SIEM, the threat intelligence and the round-the-clock roster — for a recurring fee. If an RFP uses any of the three, the evaluation criteria should be identical, and our SOC as a Service explainer covers the generic model, its delivery variants and how it differs from MDR.
One nuance is worth keeping. Some contracts labelled “managed SOC” run on your own SIEM licence, with the provider supplying only the people; SOC as a Service more often bundles the platform. Neither is better — but know which you are being quoted, because it changes both the price comparison and what you own at exit. The co-managed variant sits between the two: you keep the day shift, the provider takes nights, weekends and the specialist tiers.
The economic argument
Why rare skills are cheaper shared
A security operations centre fails on staffing arithmetic, not on technology. Covering one console seat continuously is 8,760 hours a year. An analyst on a 45-hour week, after leave, public holidays and training, delivers roughly 1,900 productive hours — so one seat takes about 4.6 full-time equivalents, and a credible three-tier roster costs around ₹1.4 crore a year in base salary before recruitment, facilities and backfill.
The deeper problem is the specialists. A malware reverse engineer or forensics analyst cannot be kept busy, sharp or retained by a single mid-sized estate — but can be across thirty. That sharing is the entire economic case for outsourcing: you are buying a fraction of skills you could never employ alone. The same logic applies to the platform: at a public reference point like Microsoft Sentinel’s ₹568.25 per GB analytics ingestion in Central India, shared, tuned infrastructure carries the bill more efficiently than a first-time deployment.
India, specifically
What the regulators actually say
Most global material on SOC outsourcing is silent on India. Indian rules are not: they name the SOC directly, and two of the three big frameworks expressly permit outsourcing it.
SEBI — CSCRF
The Cyber Security and Cyber Resilience Framework mandates a SOC for almost every regulated entity and then offers three permitted models: the entity’s own or group SOC, the Market SOC run by the exchanges and depositories, or a third-party managed SOC. Outsourcing is a sanctioned model, not a workaround — small-size and self-certification entities are directed onto the Market SOC by default.
RBI — C-SOC
The Cyber Security Framework requires a Cyber Security Operation Centre under the CISO, and Annex-2 spells out the L1, L2 and L3 tier structure. What it does not require is that you staff it yourself — the same annex candidly lists the hiring, training, compensation and retention difficulties that push banks towards external help.
CERT-In — retention
Security logs must be retained for a rolling 180 days within Indian jurisdiction, and specified incidents reported within six hours of being noticed. Both obligations survive outsourcing unchanged — they follow you, not the provider, which is why log residency belongs in the contract.
On data localisation, SEBI goes further than most expect: its framework expressly exempts IT and cyber-security data sent to a global or international SOC from localisation requirements, subject to annual IT Committee review and Board approval. So the residency rule is about where the logs live, not where the analysts sit. Our compliance services page maps these obligations — plus DPDP Act 2023 and IRDAI — to their instruments.
Where it goes wrong
Four real risks — and the clause that defuses each
Outsourced SOC failures are rarely technical. They are contractual. Each of the four below is common, and each has a one-paragraph fix available before signature.
Scroll the table sideways →
| The risk | How it shows up | The clause that defuses it |
|---|---|---|
| Notification sold as containment | You believed you had bought response; at 2 a.m. the provider phones you to say a server is encrypting itself, and waits for instructions. The SLA measured time-to-alert, and it was met. | A containment authority clause: a pre-authorised playbook listing exactly which actions — isolate host, disable account, block indicator — the provider may take without waiting, and the SLA measured to verified incident, not to alert. |
| Subcontracted tiers | The L1 desk you visited in the sales process is real; the L2 and L3 work is quietly subcontracted to a third party you have never met, possibly in another jurisdiction. | Named-subcontractor disclosure with consent rights: every tier identified by employer and location, subcontracting changes requiring written approval, and the head-contract SLA flowing down unchanged. |
| Shelfware SIEM | The platform exists, alerts fire, and nobody tunes anything. Detection content is the vendor default from onboarding day; your business-specific detections were never written. | A detection-engineering schedule: named log sources in the contract, a tuning cadence, turnaround time for new detections, and a periodic review of which rules fired and which were retired. |
| Exit hostage of your own logs | On termination you discover your historical logs, cases and detection content are in the provider’s proprietary format, extractable slowly, at cost, or not at all. | An exit clause agreed at signature: your logs and detections are your data, exportable in an open, documented format, with defined transition assistance and a deletion certificate at the end. |
Read any proposal against these four rows before reading the price. A cheap contract with the wrong answers here is the expensive option.
Before you sign
Questions to put to every provider
Useful in an RFP, useful on a first call. A longer set aimed at comparing the market is in our guide to SOC service providers in India — and we would rather you asked us these than discovered the answers during an incident.
Can you contain without waiting for us?
Isolate a host, disable an account. If the answer is no, you are buying monitoring — legitimate, but decide it deliberately and price it accordingly.
Who employs the L2 and L3 analysts, and where do they sit?
Subcontracting is common and rarely volunteered. The answer tells you who actually investigates your incidents.
Where do our logs physically live, and for how long?
CERT-In wants 180 rolling days inside Indian jurisdiction. Confirm the region and the retention, not just the promise.
Which log sources are in the price, and what does adding one cost?
Most billing disputes start here. Get the included source list and the unit price for additions into the contract.
On termination, what do we get back, in what format, by when?
Ask before signing. Extraction after a relationship sours is slow, expensive and sometimes impossible.
What does a real monthly report look like?
Ask for a redacted sample. “Executive dashboard” can mean a pie chart of alert volumes and nothing an auditor can use.
Honest arithmetic
Where in-house starts to win
Below roughly fifteen to twenty monitored servers, outsourcing wins on cost alone, and it is not close: you cannot buy 4.6 full-time equivalents of continuous cover for less than a subscription. Above that, the two models converge, and the decision stops being about price.
At scale the question becomes organisational: can you hold a night shift together, is your one SIEM engineer a single point of failure, and what happens to detection coverage the week they resign. The honest answer at genuine scale is often hybrid — keep detection engineering and the specialist tiers in-house, and buy the round-the-clock L1 cover. The full arithmetic — staffing, licensing, retention and the year-two costs — is broken down in our guide to SOC as a Service pricing in India.
Straight answers
What people get wrong about outsourcing a SOC
“Outsourcing breaks compliance”
The opposite, if anything. SEBI’s CSCRF names third-party managed SOC as one of three permitted models; the RBI requires a C-SOC under the CISO but does not require you to staff it; CERT-In’s reporting and retention duties follow you regardless of who watches the console. Outsourcing is a sanctioned model, not a workaround.
“The analysts must sit in India”
The residency rule is about where the logs live, not where the analysts sit. SEBI even exempts IT and cyber-security data sent to a global SOC from localisation, with Board approval and annual review. Indian analysts are an operational advantage — context, timezone, response time — not a legal requirement. Ours are in Delhi NCR, and we will not pretend the law demanded it.
“A SIEM is a SOC”
A SIEM is a tool; a SOC is a function. The licence buys collection and correlation — it does not buy anyone to read the output at 2 a.m., decide what matters, or act. This is the most expensive misunderstanding in the market: shelfware SIEMs bought as compliance evidence, generating alerts nobody triages.
You keep the accountability either way
Every Indian framework puts the obligation on the regulated entity, not the provider. Outsourcing moves the work, not the responsibility — which is why the contract clauses above matter more than the sales deck.
Questions we get asked
Outsourced SOC in India, answered
Is outsourcing our SOC legal for SEBI or RBI regulated entities?
Yes. SEBI’s Cyber Security and Cyber Resilience Framework mandates a SOC for almost every regulated entity and then offers three permitted models: the entity’s own or group SOC, the Market SOC operated by the exchanges and depositories, or a third-party managed SOC. The RBI requires a Cyber Security Operation Centre under the CISO but does not require you to staff it yourself. Accountability stays with you in both frameworks — the work can be outsourced, the responsibility cannot.
Do our logs stay in India if we outsource the SOC?
They must. CERT-In requires security logs to be retained for a rolling 180 days within Indian jurisdiction, and that obligation follows you regardless of who operates the SOC — so residency belongs in the contract, with the region stated explicitly. Note the separate nuance: SEBI exempts IT and cyber-security data sent to a global or international SOC from data-localisation, subject to annual IT Committee review and Board approval. The rule is about where the data sits, not where the analysts sit.
What is the difference between an outsourced SOC and an MSSP?
An MSSP traditionally operates security devices — keeping firewalls, gateways and VPNs configured, patched and healthy — and may add monitoring on top. An outsourced SOC is specifically the detection and investigation function: analysts, tiers, threat intelligence and escalation. The trap is the word “monitoring”, which in many MSSP contracts means device availability, not threat detection. Ask explicitly which one you are buying.
How do we keep control of incident response when the SOC is outsourced?
Through the escalation matrix and the containment clause, agreed before go-live. The matrix states who owns which decision at which hour; the containment clause states which actions — host isolation, account disablement, indicator blocking — the provider may take without waiting. Retain veto rights and a named internal owner, require phone escalation for P1 incidents rather than email, and rehearse the handover. Control is a documented process, not a feeling.
What should the contract say about containment authority?
Three things. First, a pre-authorised playbook listing the actions the provider may take unilaterally, scoped by system criticality. Second, the SLA clock measured to verified incident and containment action, not to alert generation. Third, the fallback: what happens when you are unreachable at 3 a.m. — who in your organisation is called, in what order, and what the provider does if nobody answers. If the contract is silent on any of these, you have bought notification, not response.
What happens to our logs and detections if we exit the contract?
Whatever the exit clause says — which is why it must be written at signature, not negotiated at termination. Your historical logs, cases and detection content should be defined as your data, exportable in an open, documented format, with a defined transition-assistance period and a deletion certificate afterwards. Providers holding your telemetry in proprietary formats create real lock-in; ask the question on the first call and get the answer into the agreement.
How much does an outsourced SOC cost in India?
Any provider quoting a figure before seeing your estate is guessing. Price follows log volume, monitored asset count and whether you are buying monitoring only or monitoring with response. The useful benchmark is the alternative: a credible in-house three-tier roster is around ₹1.4 crore a year in base salary before overheads, plus SIEM licensing and twelve to eighteen months of tuning. Below roughly fifteen to twenty monitored servers, outsourcing wins on cost alone. We will scope your estate and quote a specific monthly figure with that comparison beside it.
How quickly can an outsourced SOC be stood up?
First log sources are typically ingested within days, and meaningful detection coverage arrives in four to six weeks for a mid-market estate. The honest constraint is tuning, not integration: a SIEM newly pointed at your network produces noise, and the value comes from the weeks of baselining that follow. Any provider promising reliable detection on day one is describing alerting, not detection. Regulated entities should also allow time to align reporting workflows to CERT-In’s six-hour clock.
Next step
Get a scoped quote — with the in-house arithmetic beside it
We will scope your log sources and monitored assets, quote a specific monthly figure, and show the comparison against building it yourself. If in-house is the better answer at your scale, we will say so.
P J Networks Pvt Ltd · C-160, Mayapuri Phase II, New Delhi 110064
+91 98183 61787 · sanjay@pjnetworks.com
Related
Related to outsourcing your SOC: the SOC as a Service explainer, our managed SOC services and SLA, how to choose between SOC service providers in India, the arithmetic in SOC as a Service pricing in India, and our compliance services for SEBI, RBI, CERT-In and DPDP obligations.