A security operations centre needs a coverage model that matches the service it promises. Staffing decisions should account for incident complexity, concurrent demand, handovers, and the availability of decision-makers, not just the number of alerts arriving in an average hour.
There is no universal analyst-to-worker ratio that makes every operation safe or effective. A small team supporting a narrow service can differ substantially from a global function coordinating multiple sites, providers, and time zones.
Define the service before the rota
List the work the centre is expected to perform: monitoring, triage, workforce communications, welfare follow-up, provider coordination, and reporting. Establish which tasks require immediate attention and which can wait under an agreed service model.
Then identify the skills and authority needed. An analyst may be able to issue an approved advisory but require management approval to suspend travel or activate additional support. Staffing the monitoring desk does not automatically provide those decision rights.
Compare coverage models
An extended-hours team may suit a service whose activities are limited to defined periods, provided out-of-hours responsibilities are explicit. A continuous local rota keeps the service in one location but requires arrangements for leave, training, absence, and sustained workload.
A follow-the-sun model distributes work across regions. It needs consistent records, clear transfer times, and a process for incidents that cross the boundary between teams. Outsourced support can add capability, but the contract and operating procedures must define what the provider can decide and when the client must act.
Treat these as design options to assess, not as a ranking in which one model is always superior.
Build an escalation ladder with backups
For each incident category, define the trigger, the first decision-maker, the backup, and the action if contact fails. Include the information the receiving person needs to make the decision.
Use scenarios to test the ladder. What happens if the country manager is travelling, the primary provider cannot assist, or two incidents require the same specialist? Record how the team maintains ownership while seeking the next level of help.
JESIP's decision model can help structure the assessment that accompanies an escalation.2 It does not replace the organisation's own authority and responsibility arrangements.
Protect the transfer between shifts
A handover should identify open cases, current assessment, outstanding actions, owners, and deadlines. Allow the incoming team to ask questions and check its understanding. HSE's guidance provides a reference for designing that exchange.1
Test the handover with an unfamiliar but trained colleague. If they cannot identify the next action from the record, improve the record or process. More text is not necessarily the answer; clearer ownership and chronology may solve the problem.
Use exercises to expose capacity limits
Run a realistic exercise with several simultaneous cases, a missing contact, and an absent decision-maker. Observe what is delayed and why. Distinguish a training gap from insufficient capacity or an unclear procedure.
Document the service limitations that remain. Leadership can then make an informed decision about staffing, scope, support arrangements, or response commitments. A hidden limitation is harder to manage than an explicit one.
Frequently asked questions
Must every operations centre run 24/7?
No. Coverage should match the operational need and stated service, with clear arrangements for periods outside normal coverage.
Can an on-call manager replace a second analyst?
The roles may solve different problems. Assess workload, competence, availability, and authority rather than assuming they are interchangeable.
What should be measured?
Track meaningful delays, unresolved cases, escalation failures, handover gaps, and exercise findings alongside workload and staffing information.
Explore the workflow with AtlasNXT
Bring a workforce scenario to an AtlasNXT demonstration and explore how communications, incident coordination, and follow-up would fit your team. Book a demo.
