A managed or outsourced SOC means the organization no longer needs to define who owns incident decisions and escalation.

### Why this is right The statement is false because outsourcing monitoring does not remove the organization's need to assign decision authority, escalation routes, and response responsibilities. A provider can detect and report activity, but the client still needs a workable incident process. ### The concept A SOC may be onsite, outsourced, or hybrid. Regardless of delivery model, the organization must clarify what the provider monitors, how alerts are escalated, who can authorize containment, and how internal teams communicate. Unclear ownership can delay action even when detection works well. ### The other options - **The statement is false**: External service delivery changes who performs some tasks, not the need for governance and coordinated response. ### Terms - **Managed SOC**: Security monitoring delivered partly or wholly by an external provider. - **Escalation route**: The defined path for notifying people who must assess or act on an issue. ### Remember Outsourcing a capability does not outsource accountability for response decisions.