--- title: "NOC and managed cybersecurity | DataRoad IT" description: "NOC or SOC? What a company with 10 to 200 workstations must monitor, who gets the out-of-hours alert and what to demand in an offer. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/ source: https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > NOC or SOC? What a company with 10 to 200 workstations must monitor, who gets the out-of-hours alert and what to demand in an offer. No-obligation proposal. # NOC and managed cybersecurity: who watches your SME, and when At a glance For decision-makers short on time. - 01 The NOC watches availability; the SOC watches threats. In an SME, the same team should cover both. - 02 Up to 200 workstations, a dedicated SOC is rarely justified; five managed capabilities are enough. - 03 CERT.PT recorded 3,864 incidents in 2025, 40% more than in 2024 (CNCS data). - 04 At DataRoad, monitoring at nights, weekends and public holidays is exclusive to Premium 365. ### In this article What a board needs to guarantee is not that it “has a SOC”. It is that every relevant alert reaches someone competent, within hours that match the risk, and that this person acts. For companies with 10 to 200 workstations, this is achieved with a contracted NOC, availability monitoring with alerting, and with the essential security functions delivered as a managed service. A dedicated security team on permanent watch is almost always disproportionate. ## Who notices the problem at 10 pm on a Saturday? This is the question that separates a monitored company from one that merely “has antivirus”. A disk filling up, a failed backup, an admin account used from another country: none of these events waits for Monday. If nobody receives the warning, the problem grows until it becomes downtime or a data leak. The context has worsened. Figures from Portugal’s National Cybersecurity Centre presented to Parliament show that CERT.PT handled 3,864 incidents in 2025, a 40% rise on 2024. Nearly half began with the human factor: an email, SMS or chat message that persuades someone to open a fake link or reveal a password. Then there is the legal framework. Entities covered by NIS2 have 24 hours to report a significant incident, which presupposes detecting it first. We summarise the obligations in [what NIS2 requires of an SME](https://www.dataroad-it.com/en/nis2-smes-managed-cybersecurity-guide/). ## What does a NOC watch, and what does a SOC watch? The NOC, Network Operations Center, answers “are the systems working?”. The SOC, Security Operations Center, answers “is someone trying to get in, or have they already?”. Think of a hotel: the NOC is the maintenance team that sees on the technical panel that a lift has stopped or the air conditioning has failed; the SOC is the security team that sees on a camera someone trying to open a service door in the early hours. | Dimension | NOC: availability | SOC: threats | | --- | --- | --- | | Core question | Are the systems responding as they should? | Is there an intrusion under way or already completed? | | What is monitored | Internet links, servers, storage, memory, backups, firewalls, access points | Login attempts, accounts with abnormal use, malicious software, unusual traffic | | Typical alert | Server storage at 95%; last night’s backup unsuccessful | Finance director’s session opened from abroad | | Expected action | Prevent downtime: clear disk space, replace the disk, rerun the backup | Stop the attack: suspend the account, isolate the workstation, establish what happened | | Cost of failure | Hours without working | Data theft, fraud, encrypted files, legal duties | The boundary is blurred. A server that suddenly slows down may have a failing disk or ransomware encrypting data. That is why, in an SME, it pays to have a single team looking at availability and security rather than two providers with no context of each other. ## Does an SME really need a dedicated SOC? In most cases, no. A SOC in the classic sense (analysts on permanent watch, its own event correlation platform) is sized for large organisations. For 10 to 200 workstations, what protects the business is five capabilities contracted from an MSP: - **Managed endpoint security** Protection on workstations and servers is installed, maintained and followed up by engineers who interpret the alerts, rather than being left to run on its own. - **Managed firewall** Policies reviewed, firmware up to date and suspicious events forwarded to the team. - **MFA everywhere** Stolen credentials are the most common way in; we detail the implementation in [how to make multi-factor authentication work across the company](https://www.dataroad-it.com/en/mfa-business-14-day-plan/). - **Documented response plan** Defines who isolates a device, who informs the board and who reports to the authorities. - **Agreed coverage window** Business hours only, or also nights, weekends and public holidays, according to the business’s exposure. There are exceptions. Entities within the scope of NIS2, organisations holding sensitive clinical or financial data and operations that never stop may justify a more extensive SOC service. That conclusion should come from a risk analysis of the company, not from a product table. ## How to assess a monitoring proposal - **Scope**: demand the inventory of what is monitored: servers, workstations, firewalls, Wi-Fi, backups, Microsoft 365. - **Recipient**: does the alert go to an engineer, to a ticket queue or to a forgotten mailbox? - **Hours**: monitoring during office hours only leaves the weekend uncovered. - **Action**: is the intervention included, or do you only receive a warning to resolve internally? - **Proof**: which reports do you receive, and how often? Without a report, there is no evidence of service. ## What is included in the IT Unlimited plans? In every IT Unlimited plan from DataRoad - IT Services and Consulting, security is part of the service: monitoring with alerting, managed firewalls and probes, protected and supervised endpoints, two-factor authentication and maintenance of the cybersecurity platforms. Every alert is handled by our engineering team through remote, on-site or telephone support, with immediate response times. | Plan | Monitoring and support window | | --- | --- | | Essential | Working days during business hours; remote and telephone support | | Premium | Working days during business hours; unlimited on-site assistance | | Premium 365 | 24/7 monitoring and support in Premium 365, including nights, weekends and public holidays | There is no ambiguity: round-the-clock coverage is exclusive to the [Premium 365 plan](https://www.dataroad-it.com/en/premium-365-24-7-managed-it/). To see the difference between anticipating failures and firefighting, read [why proactive monitoring costs less than reactive support](https://www.dataroad-it.com/en/noc-proactive-monitoring-vs-reactive/). ## How does it work with real clients? [Ventask](https://www.dataroad-it.com/en/ventask-managed-firewalls-350-workstations/) has worked with DataRoad since 2016 and has more than 350 workstations. A single team administers the corporate firewalls, switches and access points, deploys and manages endpoint security, maintains the cybersecurity platforms and provides proactive 24/7 monitoring with alerting under Premium 365. When the firewall raises an alert, whoever analyses it knows the topology, the servers and the people, and wastes no time opening requests with a third party. On a different scale, [Boost Portugal](https://www.dataroad-it.com/en/boost-portugal-redundant-internet-managed-it/) has an annual contract with remote monitoring of all systems, alarms and availability reports. ## Frequently asked questions ### How do a NOC and a SOC differ? The NOC tracks availability (internet, servers, storage, backups, network) and the SOC tracks threats (unauthorised access, compromised accounts, malware, anomalous traffic). In an SME, the most effective approach is for the same team to cover both. ### Should a company with 30 workstations hire a SOC? As a rule, not a dedicated SOC. It needs managed endpoints and firewall, MFA, a written response plan and a coverage window proportionate to the risk. ### Does DataRoad monitor 24/7? Only in the IT Unlimited Premium 365 plan, which includes nights, weekends and public holidays. Essential and Premium operate during business hours. ### With monitoring in place, is antivirus still needed? Yes. The protection installed on workstations remains essential; monitoring ensures that the alerts it and the firewall generate are seen and acted upon. ## Next step: monitoring assessment in 7 working days We map what is monitored today, the gaps, who receives each alert and at what hours, and present a no-obligation proposal sized to your company’s risk. Discover our [NOC and infrastructure monitoring service](https://www.dataroad-it.com/en/noc-it-monitoring-portugal/) and our [cybersecurity and managed firewall offering](https://www.dataroad-it.com/en/managed-cybersecurity-services/). **More than 10 workstations · support contract · remote, on-site and telephone support.** Call +351 211 459 950 * or write to sales@dataroad.pt. **Call to a Portuguese landline.* ## Sources - [Lusa/DNoticias: CNCS figures on incidents in 2025](https://www.dnoticias.pt/2026/4/28/490057-incidentes-de-seguranca-informatica-em-portugal-aumentaram-40-em-2025/) - [Regulation No. 756/2026, Diário da República (notification deadlines)](https://diariodarepublica.pt/dr/detalhe/regulamento/756-2026-1134399056) Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/)[Managed IT and cybersecurityManaged backup: the 30-minute restore test that proves itA backup never restored is a deferred risk. In 30 minutes, an old document, a deleted email and a server booted in isolation show whether th…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/managed-backup-30-minute-restore-test/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed cybersecurity ## One StepAhead of IT. The risk belongs to the board, the protection is ours. In 11 years, DataRoad has never suffered a security incident. - **0** DataRoad security incidents in 11 years - **232** companies protected - **MFA** on every managed account We do **IT** right. DataRoad IT Unlimited ## Does your IT depend on a single person? Documentation, inventory and one contact who answers for everything. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/