Managed SOC and NOC: what they are and whether a SME needs them

7 min read · DataRoad

SOC and NOC managed These are two ways of monitoring a company’s IT, with different questions. The NOC asks “is everything working?” The SOC asks “is someone trying to get in?” A SME doesn’t need two rooms full of screens to get both answers — it needs contracted monitoring, with alerts that reach those who know how to act, and a coverage schedule that matches the risk of the business.

This article explains the two acronyms without jargon, which makes sense for a company with 10 to 200 employees, and what it should require of those who provide the service.

NOC and SOC, explained without acronyms

In practice, the two things overlap. A very slow server can be a failing disk — or a malicious program encrypting files. Therefore, in a SME, a team that looks at both things makes more sense than two suppliers that don’t speak to each other.

Why has this become a matter for management?

Attacks no longer discriminate based on size. According to data from the National Cybersecurity Center presented in Parliament, CERT.PT recorded 3,864 incidents in 2025, 40% more than the previous year, and about half of them exploited the human factor — emails, SMS messages, or messages that lead someone to click on a fake link or provide a password.

There is also the legal issue. For companies covered by NIS2, a significant incident must be reported within the first 24 hours. We explained the deadlines in the guide NIS2 explained for SMEs. Notifying within 24 hours is only possible if someone reports the incident in time.

Does an SME need a SOC?

It depends on what you mean by SOC. A dedicated team, analyzing security events around the clock with proprietary correlation tools, is an investment designed for large organizations. For most companies with 10 to 200 employees, it is disproportionate.

What makes sense is having the essential functions of a SOC delivered as a service:

• Managed protection on computers and servers — installed security software that is updated and monitored by someone who knows how to interpret the alert, not just an antivirus that no one checks.
• Managed firewall — rules maintained, updates applied and suspicious traffic alerts forwarded to the technical team.
• Multi-factor authentication on all accounts — because most attacks start with a stolen password. See our article about MFA in the company.
• Written response procedure — who decides to shut down a computer, who talks to the management, who notifies the authorities.
• Defined coverage schedule — working hours, or nights, weekends and holidays, depending on the risk of the business.

Companies covered by NIS2 that have sensitive health or financial data, or that have a continuous operation, may justify a more comprehensive SOC service. In these cases, we recommend that this decision come from a risk assessment, not from a catalog.

What to ask those who sell you “surveillance”

1. What is being monitored? Ask for the list: servers, workstations, firewalls, Wi-Fi, backups, Microsoft 365 accounts.
2. Who receives the alert? One person, one ticketing system, one email that no one reads?
3. At what time? “Monitoring” from 9 a.m. to 6 p.m. does not protect the weekend.
4. What happens after the alert? Is there an answer included or just a warning for your team to resolve?
5. What reports do you receive? If you never see a report, you don't know if surveillance exists.

What DataRoad does — and what it does not promise

Security is included in the IT Unlimited plans: monitoring with alarm management, firewalls and managed probes, managed protection of computers (endpoints), two-factor authentication, and maintenance of cybersecurity solutions. Alerts reach our technical team, which resolves the issue via remote, on-site, or phone support, with immediate response times.

Regarding schedules, we are clear: the monitoring and 24/7 support only exist in the IT Unlimited Premium 365, The plan with coverage for nights, weekends, and holidays. The Essential and Premium plans do not include nights, weekends, and holidays. To understand the difference between detecting before and reacting after, read Proactive monitoring vs reactive support.

A real case: 350 posts monitored by a single team

A Ventask, With more than 350 jobs and a DataRoad client since 2016, it has the infrastructure monitored and managed by the same team: administration and maintenance of corporate firewalls, switches and access points, management and implementation of security solutions at the points (endpoint security), maintenance of cybersecurity solutions and monitoring with proactive alarm 24/7, as part of the Premium 365 plan.

Operation and security stay in the same place. When a firewall alerts, anyone who sees the alert knows the network, the servers, and the users — and doesn’t need to open a request to another provider to find out what’s on the other side.

On a different scale, the Boost Portugal has an annual contract with remote monitoring of all systems, alerts, and availability reports.

Frequently Asked Questions

What is the difference between NOC and SOC?

The NOC oversees the operation: the internet, servers, disks, backups, and network equipment. The SOC oversees security: attempts to access, compromised accounts, malware, and suspicious traffic. In a SME, it makes sense for the same team to handle both of these things.

Does a 30-person company need a SOC?

Rarely from a dedicated SOC. It needs the essential functions: managed protection on computers, managed firewall, multi-factor authentication, a response procedure, and a coverage schedule appropriate to the risk.

Is the DataRoad monitoring available 24/7?

Only the IT Unlimited Premium 365 plan includes coverage for nights, weekends, and holidays. The Essential and Premium plans do not include coverage for nights, weekends, and holidays.

Does monitoring replace antivirus protection?

No. Protection on computers remains necessary. Monitoring ensures that someone sees and acts on the alerts generated by that protection and the firewall.

Monitoring map of your company in 7 working days

We identify what is being monitored today, what is not, who receives the alerts and at what time — and deliver a coverage proposal tailored to the risk of your business. For companies with more than 10 locations · contract assistance · remote and on-site support. Get to know us IT monitoring and the area of cyber security for business.

Sources

• Lusa / DNoticias — CNCS data: 3,864 incidents recorded by CERT.PT in 2025 (+40%)
• Diário da República — Regulation No. 756/2026 (Regulation on the Legal Regime of Cybersecurity), notification of incidents