Parent folderOpen Confluence

RWS Architecture article

Security Operations Center

Security Operations Center is the product-neutral architecture building block for security monitoring, detection, response, and evidence handling. It states what DC 3.0 needs from

  1. Typeabb
  2. Statuscandidate
  3. Domainsecurity
On this page
  1. ABB Security Operations Center
  2. Summary
  3. Capabilities
  4. Constraints
  5. Service Description
  6. Roadmaps
  7. Landing Zones
  8. Interfaces
  9. Dependencies
  10. EIRA Alignment
  11. Available SBB's

ABB Security Operations Center

Summary

Security Operations Center is the product-neutral architecture building block for security monitoring, detection, response, and evidence handling. It states what DC 3.0 needs from this capability before a concrete SBB, product, or operating model is selected.

Capabilities

  • Provides security monitoring, detection, response, and evidence handling.
  • Defines the functional, technical, security, and quality expectations that SBBs must satisfy.
  • Keeps service ownership, interfaces, and consumption boundaries visible before product selection.
  • Enables traceability from architecture intent to implementation, operational evidence, and consuming services.

Constraints

  • The resulting SBB must fit the security ownership model and document the support, lifecycle, and service-management boundary.
  • Security, privacy, logging, evidence, and compliance controls must be explicit enough to assess BIO2-aligned implementation where applicable.
  • Security telemetry must be complete enough to support incident response and compliance evidence.
  • SBBs must define data retention, escalation, and integration responsibilities.

Service Description

This ABB offers a SOC service that consumes DC 3.0 security signals and coordinates detection, triage, response, and reporting. It is consumed by solution architects, platform teams, and service owners as the capability contract for selecting and shaping SBBs.

The service description remains implementation-neutral: product selection, hosting pattern, detailed runbooks, and service levels belong in the mapped SBB and related ADRs.

Roadmaps

  • Baseline: confirm scope, service ownership, constraints, and acceptance criteria for Security Operations Center.
  • MVP: identify candidate SBBs and connect them to the service, support, and lifecycle model.
  • Next: add measurable service levels, evidence requirements, and roadmap dependencies once the SBB is selected.

Landing Zones

  • Private cloud and central DC 3.0 landing zone for core infrastructure and platform services.
  • Government cloud or external cloud landing zones only when the SBB documents the required control set, connectivity model, and data classification fit.

Interfaces

  • Log, event, alert, and case-management interfaces.
  • Identity, network, workload, and platform telemetry feeds.
  • Incident response and reporting integrations.

Dependencies

  • Depends on federated-authentication for a supporting capability or integration boundary.
  • Depends on dc-network-structure for a supporting capability or integration boundary.
  • Depends on clusters-as-a-service for a supporting capability or integration boundary.
  • No implementing SBB is mapped yet; candidate SBB selection is a dependency for further elaboration.
  • Consuming ABB and SBB dependencies must be recorded as links when solution design identifies concrete upstream or downstream use.

EIRA Alignment

Available SBB's

  • No SBB is available yet. Candidate selection must be completed before this ABB can be promoted beyond capability intent.