How to evaluate SOC service providers.

Why ranked provider lists don't settle it

Search for SOC providers in India and you will find ranked lists. They are useful for building a longlist and useless for choosing, because they rank marketing reach, not operational behaviour. Two providers can sit beside each other on the same list while one runs genuine detection engineering and the other forwards alerts from a tool you could have bought yourself. The only way to tell them apart is to ask questions whose answers are hard to fake — and to ask every shortlisted provider the same ones, so the answers are comparable. A practical shortlist is three names drawn from at least two of the provider types below: three is enough to price against and few enough to evaluate properly, and mixing the types stops you comparing three versions of the same trade-off.

The five kinds of provider you will actually meet

Almost every shortlist drawn up in India is a mix of these five. They are not tiers of quality — each is the right answer for some buyer — but they strain in different and fairly predictable ways, and the failure mode is what you are really choosing between. Work out which type each name on your list belongs to before you compare anything else, because it explains most of what follows in their proposal.

• Global MSSP — genuine follow-the-sun coverage and deep threat intelligence, but India-specific reporting is often bolted on and at mid-market size you are a small account on a large panel.
• Indian pure-play MSSP — CERT-In, SEBI and RBI reporting are native rather than translated, and the analysts share your timezone; depth varies enormously between firms with near-identical websites.
• IT-services SOC arm — bundles neatly into an infrastructure contract you already hold, but security competes with infrastructure for the same people and the same budget.
• Boutique or regional specialist — responsive and often strong on sector knowledge; round-the-clock cover rests on a thin roster, so ask who covers the 02:00 shift on Diwali, by name.
• Product-vendor or platform-led provider — the deepest knowledge of one stack, and detections written by the people who built it; coverage stops where that platform's telemetry stops. PrahiX sits here, which is a limitation as much as a strength.

Empanelment, certification, and what each one actually proves

This is where most Indian SOC evaluations go wrong. Three credentials get quoted constantly on provider websites, each proves something real, and none of them proves what it is usually used to imply. Worth reading before the demos, because it changes which providers you take seriously.

• CERT-In empanelment is an auditor panel, not a SOC panel. The scheme is titled Empanelment of Information Security Auditing Organisations, and its terms and conditions — version 7.2, April 2024 — qualify a firm to perform information security audits. The document states that an auditor is contracted by the customer directly and that CERT-In is not a party to that contract, and it makes no reference to security operations centres, monitoring or managed security anywhere in its terms. An empanelled firm may well run an excellent SOC; the empanelment is not evidence of it.
• There is no licence to operate a SOC in India. No Indian authority licenses, accredits or approves managed security service providers or security operations centres as a category. A provider implying it is government-approved to run a SOC is describing something that does not exist — treat that as information about how the rest of their claims are worded.
• An ISO 27001 certificate is only as good as its scope statement. Ask for the certificate rather than the logo on the slide. The scope line names which parts of the business are covered, and a certificate scoped to a head office or a development centre says nothing about the operations centre watching your network at night. Apply that to us too: PrahiX publishes ISO/IEC 27001:2022 and ISO 9001:2015, and you should ask us for the certificates and read the scopes exactly as you would of anyone else on your list.
• SOC 1 and SOC 2 are not this kind of SOC. They are System and Organization Controls attestation reports issued by a licensed CPA firm under the AICPA framework, not an operations centre. The acronym collision costs real time in procurement and occasionally produces an RFP asking a monitoring provider to issue an attestation it cannot issue.
• When empanelment genuinely does matter: if you are deliberately consolidating audit and monitoring with one firm, it is a fair tiebreaker for the audit half of the scope. Price the two halves separately, and note the independence question that follows — the same firm would then be auditing controls it operates.

Does the SLA cover response, or only notification?

This is the widest gap in the market. Many services are contractually complete once they have told you about an incident — the SLA clock stops at notification, and containment is your problem at whatever hour it lands. A response SLA keeps the clock running until something has actually been done: a host isolated, a token revoked, an address blocked. Read the SLA for the verb it commits to. If the commitment is to inform, the overnight shift you are paying for is a messenger, not an operation. Then read the exclusions — maintenance windows, log-source outages and low-severity carve-outs are where the headline number is really made.

What is the provider authorised to contain?

Response authority is agreed, not assumed. A capable provider will ask you, during onboarding, which containment actions may run unattended, which need approval, and which stay advisory — per action type and per environment. Be wary of either extreme: a provider that wants no authority at all is planning to notify and step back, and one that wants blanket authority on day one has not thought about your change-control. The right answer is a documented authority matrix that starts conservative and widens as trust builds.

Where do your logs live, and who can produce them?

India's CERT-In directions require covered organisations to report listed cyber incidents within six hours of noticing them, and to enable logs across ICT systems and retain them for a rolling 180 days within Indian jurisdiction. When an incident report is due, the logs behind it must be producible quickly — so log custody is an operational question, not a paperwork one. A provider who hesitates on any of the following has answered the question.

• Which jurisdiction holds the logs, and can Indian-jurisdiction storage be committed to in writing?
• How quickly can raw logs for a given period be exported on request?
• Is 180-day rolling retention included in the base price, or an extra?
• What is deleted, returned or transferred when the contract ends?

The regulatory questions that only apply in India

A provider can be excellent at detection and still be the wrong answer for an Indian regulated entity, because the reporting obligations attach to you and are discharged on your clock. Four instruments come up most often. Verify the current text applicable to your own entity before writing any of this into an SLA — including anything on this page. None of it is legal advice.

• CERT-In, Direction No. 20(3)/2022 of 28 April 2022 — specified incidents reported within six hours of noticing them, and logs retained for a rolling 180 days within Indian jurisdiction. Ask who drafts and files the report, and to see a redacted one the provider has actually filed.
• SEBI CSCRF — recognises an own or group SOC, a Market SOC, and a third-party managed SOC. Small-size and self-certification regulated entities are directed onto the Market SOC rather than choosing freely. On ISO 27001 for a third-party SOC, the technical clarification of 28 August 2025 made certification encouraged and recommended rather than mandatory for Qualified REs; it remains mandatory for market infrastructure institutions. Ask which of the three models a proposal places you in, and whether your RE category permits it.
• RBI — the binding requirement in the cyber security framework is to report promptly. The two-to-six-hour figure that circulates in vendor decks comes from an annexure template heading rather than the operative requirement, so do not build an SLA on it without reading your own circular. Ask for the provider's contractual notification time in writing, and whether it starts at detection or at triage.
• DPDP — the Rules were notified in November 2025 and commence in phases. Consent-manager registration falls in November 2026; the substantive obligations, including reasonable security safeguards and breach notification, commence in May 2027, with the Board told without delay and a detailed report within 72 hours. Penalties reach Rs 250 crore for a failure of reasonable security safeguards. It is not operative yet, so ask what changes in May 2027 and whether that change sits inside the fee you are signing today.

Who owns the tooling — and what happens when you leave?

In some engagements you license the SIEM and the provider operates it; in others the platform belongs to the provider and you subscribe to the outcome. Both models work, but they fail differently at exit. If the tooling is yours, you keep the detections and the history but must re-staff the operation. If it is theirs, ask before signing: which detections, dashboards, incident timelines and tuning survive a migration, and in what format? An engagement you cannot leave without starting from zero is priced with that lock-in included, whether or not it appears on the quote.

Fully managed or co-managed?

If you have no security analysts and no plans to hire, a fully managed service is the honest fit. If you have a team you want inside the loop — working investigations on the provider's platform, keeping business context and approvals in-house while the provider carries the platform and the overnight watch — you are describing a co-managed SOC, and you should evaluate providers on how well they support that model rather than whether their brochure mentions it. Ask to see the actual console access your analysts would get, not a screenshot.

Reporting cadence, and what an escalation contains

Ask for a sample escalation from a real (redacted) incident and a sample of the monthly report. A good escalation arrives with context — what fired, what was correlated, severity, what was already contained, and a recommended next action. A good monthly report shows trends, tuning decisions and false-positive rates, not a page count of alerts. Providers are proud of these artefacts when they are good; reluctance to show them is a signal in itself.

The checklist, in one place

Put every shortlisted provider through the same twelve questions and score the answers side by side. They are ordered so the cheap disqualifiers come first.

• Which of the five provider types are you, and who directly employs the analysts — by tier, not as a group headcount?
• Where do those analysts physically sit at 02:00, and what is the escalation path at that hour?
• Does the SLA commit to response, or only to notification — and what are the exclusions?
• Which containment actions can run unattended, and how is that authority agreed?
• Where are our logs stored, in which jurisdiction, and can 180-day rolling retention and rapid export be committed to in writing?
• Who owns the SIEM and the detections — and what leaves with us at exit, in what format?
• How is ingest priced, and what happens in the month a noisy log source doubles our volume?
• Is co-managed access to the platform available for our analysts?
• Are detections mapped to a published framework such as MITRE ATT&CK — and will you show the techniques you do not cover?
• What does a real escalation look like, redacted, and what is in the monthly report?
• Which compliance reports come out of the box — CERT-In, RBI, SEBI CSCRF, DPDP?
• Give us a reference in our sector, at our size, that left you.

Signals worth more than a reference call

Collected from procurement processes that went well, went badly, and occasionally ended with someone being advised to walk away. Every provider can produce a happy reference; these are harder to stage.

• A claim of being government approved or government certified to run a SOC — no such approval exists in India.
• A headcount in the hundreds that turns out to be a group figure; ask how many sit in the operation that would serve you, on which shifts.
• AI-driven with no stated mechanism; ask which decisions are automated, on what data, and what happens when the model is wrong at 03:00.
• Time-to-alert as the only committed metric, with nothing said about verified incidents.
• Unlimited log ingest, which usually means collection is quietly capped or the price resets at renewal.
• Compliance content that has gone stale — a proposal presenting the DPDP 72-hour rule as though it binds you today has not been reviewed recently.
• A twelve-month lock on an unproven detection capability; a confident provider can afford a ninety-day break clause.
• As a positive signal: a provider who tells you plainly when someone else is the better fit. It is rarer than it should be.

What PrahiX is, and is not

PrahiX is a platform-led provider: SIEM correlation and SOAR response are one system rather than an integration, and network, security and camera telemetry share a single timeline. That changes several checklist answers at once — there is no separate SIEM licence in the price, and the exit question becomes about exporting your data and history rather than untangling shared tooling. It is not automatically the right model for you. We are not an audit firm and we are not CERT-In empanelled, so if your board or regulator requires an audit signed by an empanelled auditor, appoint one — that is a separate engagement from monitoring, and any provider telling you their monitoring contract satisfies it is wrong. We are not a licensing authority and hold no government approval to run a SOC, because none exists. And there are buyers we are the wrong answer for: if you are consolidating audit and monitoring into one firm, an empanelled auditor with a credible SOC suits you better; if you are a SEBI small-size or self-certification regulated entity directed onto the Market SOC, that is your route and we will say so; and if your estate is genuinely single-vendor, that vendor's own SOC has telemetry depth we cannot match. Whoever you evaluate, including us, make them place themselves on this map.