Switching SOC provider: how the transition works without a gap

• Unclear scope of service: it stays open whether and in whose mandate the provider responds.
• Response times are not contractually committed or cannot be evidenced.
• Collaboration stalls: no follow-up questions, no handover, no joint reviews.
• The environment changes: cloud, new log sources or regulatory requirements the current setup does not cover.

These reasons are a normal outcome of annual review, not a judgment on the previous provider. Not every switch pays off: if notice periods and migration effort outweigh the benefit, revisit the switch in a later cycle.

• Contract: term, notice period, data handover clauses, exit support.
• Use cases: which detection rules are active, with logic and exceptions documented.
• Playbooks: escalation paths, contacts, approvals for isolation and containment.
• Log sources: which feed in, licences, retention and audit requirements.
• Evidence: past response times, incidents, handover documentation.

The outgoing provider must cooperate as far as the contract provides; agree the scope and format of the handover in writing. Data handover does not mean delivery of a ready-made operation: the new provider maps the documentation onto its own setup.

In parallel operation, the new provider detects and responds while the old one is still running. Both see the same alerts; differences are resolved in joint reviews. When the parallel period ends, the new provider takes over completely. ANOMAL offers 30 days of parallel operation for this transition, so no gap opens between contract end and full operation.

Your existing tools stay in use: EDR, firewall, identity platform and cloud configuration are not replaced. The new provider connects the sources and handles response in its own mandate.

• Notice period and data handover clauses in the current contract reviewed.
• Use cases and playbooks documented and handed to the new provider.
• Log sources, licences and retention listed.
• Parallel operation agreed with a fixed end date.
• Escalation paths and approvals named for the transition period.
• First joint review after the parallel period scheduled.

• Giving notice without a fixed start date with the new provider, leaving a coverage gap.
• Handing over use cases as raw exports, without logic and exceptions.
• No parallel operation, so alerts go unanswered during the move.
• Replacing tools early that the new provider would keep running.

The SOC as a Service Switzerland page describes what operation looks like after the switch.