NOC and managed cybersecurity: who watches your SME, and when

This is the question that separates a monitored company from one that merely “has antivirus”. A disk filling up, a failed backup, an admin account used from another country: none of these events waits for Monday. If nobody receives the warning, the problem grows until it becomes downtime or a data leak.

The context has worsened. Figures from Portugal’s National Cybersecurity Centre presented to Parliament show that CERT.PT handled 3,864 incidents in 2025, a 40% rise on 2024. Nearly half began with the human factor: an email, SMS or chat message that persuades someone to open a fake link or reveal a password.

Then there is the legal framework. Entities covered by NIS2 have 24 hours to report a significant incident, which presupposes detecting it first. We summarise the obligations in what NIS2 requires of an SME.

The NOC, Network Operations Center, answers “are the systems working?”. The SOC, Security Operations Center, answers “is someone trying to get in, or have they already?”. Think of a hotel: the NOC is the maintenance team that sees on the technical panel that a lift has stopped or the air conditioning has failed; the SOC is the security team that sees on a camera someone trying to open a service door in the early hours.

The boundary is blurred. A server that suddenly slows down may have a failing disk or ransomware encrypting data. That is why, in an SME, it pays to have a single team looking at availability and security rather than two providers with no context of each other.

In most cases, no. A SOC in the classic sense (analysts on permanent watch, its own event correlation platform) is sized for large organisations. For 10 to 200 workstations, what protects the business is five capabilities contracted from an MSP:

• Managed endpoint security Protection on workstations and servers is installed, maintained and followed up by engineers who interpret the alerts, rather than being left to run on its own.
• Managed firewall Policies reviewed, firmware up to date and suspicious events forwarded to the team.
• MFA everywhere Stolen credentials are the most common way in; we detail the implementation in how to make multi-factor authentication work across the company.
• Documented response plan Defines who isolates a device, who informs the board and who reports to the authorities.
• Agreed coverage window Business hours only, or also nights, weekends and public holidays, according to the business’s exposure.

There are exceptions. Entities within the scope of NIS2, organisations holding sensitive clinical or financial data and operations that never stop may justify a more extensive SOC service. That conclusion should come from a risk analysis of the company, not from a product table.

1. Scope: demand the inventory of what is monitored: servers, workstations, firewalls, Wi-Fi, backups, Microsoft 365.
2. Recipient: does the alert go to an engineer, to a ticket queue or to a forgotten mailbox?
3. Hours: monitoring during office hours only leaves the weekend uncovered.
4. Action: is the intervention included, or do you only receive a warning to resolve internally?
5. Proof: which reports do you receive, and how often? Without a report, there is no evidence of service.

In every IT Unlimited plan from DataRoad - IT Services and Consulting, security is part of the service: monitoring with alerting, managed firewalls and probes, protected and supervised endpoints, two-factor authentication and maintenance of the cybersecurity platforms. Every alert is handled by our engineering team through remote, on-site or telephone support, with immediate response times.

There is no ambiguity: round-the-clock coverage is exclusive to the Premium 365 plan. To see the difference between anticipating failures and firefighting, read why proactive monitoring costs less than reactive support.

Ventask has worked with DataRoad since 2016 and has more than 350 workstations. A single team administers the corporate firewalls, switches and access points, deploys and manages endpoint security, maintains the cybersecurity platforms and provides proactive 24/7 monitoring with alerting under Premium 365. When the firewall raises an alert, whoever analyses it knows the topology, the servers and the people, and wastes no time opening requests with a third party.

On a different scale, Boost Portugal has an annual contract with remote monitoring of all systems, alarms and availability reports.

We map what is monitored today, the gaps, who receives each alert and at what hours, and present a no-obligation proposal sized to your company’s risk. Discover our NOC and infrastructure monitoring service and our cybersecurity and managed firewall offering.

More than 10 workstations · support contract · remote, on-site and telephone support.

Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.

• Lusa/DNoticias: CNCS figures on incidents in 2025
• Regulation No. 756/2026, Diário da República (notification deadlines)