Utility SOC Build

When this fits

You run network or generation assets and need to see attacks on them, and to respond without disrupting supply.

What the work covers

• Log and telemetry sources chosen from your IT and operational estate.
• Detection rules mapped to a threat model for the assets.
• Triage and escalation procedures that name who may act on a live asset.
• A rehearsal of an incident against the procedures.

What you receive

• The monitoring configuration and detection rules, with the sources they read.
• Triage and escalation procedures.
• The rehearsal record and the changes it led to.

How completion is decided

Chosen scenarios are replayed and each is detected by the intended rule and handled by the written procedure, or the gap is recorded.

What you provide

• Access to the log sources and the people who run the assets.
• A named authority for decisions that touch live operations.

What RJV does not promise

• A fixed price or duration before the scope is known.
• Regulatory approval or a certificate; the customer remains the regulated party.
• That an attack will be prevented; the work improves detection and response.

How to start

Describe the problem on the Work with Us page. Every engagement follows the stages on the engineering page, and the commercial terms explain what determines scope and how the work is charged. Ownership at handover is described in deployment and ownership.