National Cybersecurity Authority
Assess managed SOC regulatory readiness, provider eligibility, customer responsibilities and evidence under NCA’s national policy and licensing framework.
NCA publishes two complementary instruments for managed security operations centers: the National Policy for Managed Security Operations Centers and the Regulatory Framework for Licensing Managed Security Operations Center Services. The published documents identify NPMSOC-1:2024 and RFMSOC-1:2024. The national policy addresses how beneficiary organizations obtain appropriate services, while the licensing framework addresses authorization and obligations for service providers. These are related but distinct responsibilities.
IRIS Technology can support readiness analysis, service-boundary mapping and preparation of implementation evidence within an agreed advisory scope. The practical activities below describe ways to organize that preparation; they are not a claim that IRIS holds an NCA MSOC license, personnel qualification or regulatory approval. Any regulated service delivery must be assessed separately against the provider’s verified authorization, license scope and applicable conditions before contracting or operation.
Confirm whether the engagement concerns a beneficiary procuring monitoring services, a provider seeking authorization, or both. NCA’s policy and licensing materials distinguish Tier 1 and Tier 2. Tier 1 permits service provision to all entity categories; Tier 2 excludes government entities and entities owning, operating or hosting critical national infrastructure. NCA also states that the national policy directs government and relevant CNI entities to obtain SOC services through a Tier 1 licensed provider.
Provider readiness and customer readiness therefore require separate evidence. A provider should establish the applicable licensing, personnel-qualification and service requirements. A customer should verify the selected entity and tier against current official records, define service coverage and retain accountable internal coordination. General cybersecurity-provider registration, a product certification or a technology partnership should not be treated as evidence of an MSOC license. Confirm current directions and the actual service model before making an applicability conclusion.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Regulatory role and eligibility | Separate beneficiary requirements from provider authorization and confirm the relevant service model. | Applicability record, verified provider status and agreed scope. |
| Service and telemetry coverage | Map assets, log sources, monitoring responsibilities and uncovered dependencies. | Coverage matrix, onboarding records and documented limitations. |
| Operational accountability | Define alert triage, escalation, customer decisions and authorized response actions. | Responsibility matrix, procedures and exercise findings. |
| Provider preparation | Assess evidence needed for applicable licensing and personnel requirements. | Requirement register, qualification evidence and remediation ownership. |
| Assurance and improvement | Review service outcomes, evidence availability and unresolved operational gaps. | Review reports, tracked actions and verified improvements. |
Verify the provider’s current Tier 1 status and the legal entity named in the agreement before reviewing the proposed operating model. Then map actual monitoring coverage, escalation and customer responsibilities.
Build a requirement-to-evidence register and distinguish existing operational capability from missing approvals, qualifications or documentation. Preparation work does not itself authorize delivery of a regulated service.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
No. The policy and framework have complementary purposes. Assess the beneficiary’s procurement and operating obligations separately from the provider’s authorization and continuing requirements.
No. Registration and MSOC licensing are distinct regulatory arrangements. Verify the specific service provider, current license tier and permitted scope using NCA’s official information.
NCA’s published licensing information excludes government entities and entities owning, operating or hosting critical national infrastructure from the Tier 2 scope. Confirm the customer’s classification before procurement.
A contract should make operational responsibilities explicit. Customers still need to coordinate asset coverage, decisions, escalation and evidence so outsourced monitoring supports their own security operations.
No. It describes readiness and advisory support. Eligibility to deliver a regulated MSOC service must be independently verified for the proposed provider and engagement.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness