Adopting ASSURED in your SOC
An individual analyst can adopt ASSURED alone by reading the chapters and using the structure; nothing on this page is required for that. This page is for the SOC lead or manager taking a team onto the methodology, which is a different project: it touches tooling, tickets, tier definitions, and habits, and it fails in predictable ways when run as a memo. The arc below is deliberately incremental, and its stages are ordered so that each one produces the evidence the next one needs.
The rollout arc
Stage 1 · Pilot small 2-3 weeks
Two to four analysts, one or two alert families they already know well. They work their normal queue but write ASSURED-shaped records: close notes against the rubric, handoff packets on escalations, phase vocabulary in their case notes. No tooling changes, no renamed fields, no announcements. The pilot’s outputs are a stack of real records in the new shape and a friction list: where the methodology fought the case tool, where a phase felt redundant for the alert family, where the templates needed a local field.
Exit when: the pilot analysts can defend their close notes to each other using the shared vocabulary, and the friction list has stopped growing.
Stage 2 · Baseline before changing anything 1-2 weeks, parallel
Measure the current state while it still exists: pull ninety days of history for the metrics below, and rubric-score a random sample of twenty existing close notes. This step gets skipped in most rollouts, and its absence is why most rollouts cannot answer “did this help?” a year later. The baseline is also the honest sales pitch to the team: if escalation rework and reopen rates are already visible problems, the methodology arrives as a solution rather than a compliance exercise.
Exit when: the numbers are written down somewhere they cannot be quietly revised.
Stage 3 · Train the team 4 sessions or 1 ramp
The teaching guide’s four-session plan, facilitated by the pilot analysts, whose real records from Stage 1 become local worked examples alongside the site’s three cases. The one-page reference goes up at every desk; the exercise packets run in-session. Vocabulary adoption is the checkpoint that matters: the letters showing up unprompted in handoffs and standups is the signal the training landed.
Exit when: every analyst has produced at least one rubric-passing close note on a real case.
Stage 4 · Reconcile policy and tooling the long stage
Now, and only now, change the machinery. Map existing SOPs and playbooks to the phase deliverables: most survive as-is under a vocabulary crosswalk, and a rename is only worth its retraining cost where the old term actively conflicts (a playbook whose “escalation” step means “assign to senior analyst” needs the rename; one whose steps are just unlabeled A-S-S needs a header). Wire the templates into the case-management tool as forms or macros so the structure is the path of least resistance. Reconcile tier definitions with the protocols page’s model, and negotiate the pre-authorized immediate-actions list with IR in writing, because Stage 5’s break-glass discipline depends on it existing.
Exit when: an analyst can run the full arc without leaving the case tool, and nobody needs the crosswalk taped to their monitor anymore.
Stage 5 · Operate and review ongoing
The steady state has four moving parts: the pattern library with a named owner and enforced review dates, the QA cadence (a weekly sample of close notes against the rubric, graded kindly and in the open), the quarterly metrics review against the Stage 2 baseline, and the feedback loop upstream, where local deviations that keep proving right become contributions to the methodology itself. The maturity model below is the map for this stage.
Adopt the vocabulary, not a re-org
The expensive failure mode is the big-bang rollout: rename every queue, retrofit every playbook, and announce a new era. Six weeks later the team has reverted and the methodology is blamed. ASSURED is a way of working a case, not an org design; it coexists with any tier structure, any SIEM, and any ticket taxonomy. Adopt the thinking first, let the tooling follow the friction list, and treat every rename as a cost to be justified.
Measuring triage quality
Speed metrics measure how fast the queue moves; they say nothing about whether the verdicts were right. Mean time to detect, respond, or close are worth tracking, but as paired metrics only: speed with no quality check optimizes for confident, fast, wrong. The metrics below measure decision quality, and each one carries its failure mode, because any metric made a target gets gamed.
Escalation acceptance quality of the E decision
The share of escalations that IR accepts as genuinely warranting IR. Low acceptance means noisy escalation, criteria applied loosely, or packets too thin to judge. The trap: driving it to 100%, which a team achieves by under-escalating; a healthy number sits below perfect, because some defensible escalations legitimately turn out benign. Pair it with the missed-incident count, never read alone.
Reopen rate honesty of the closes
Closed cases reopened on new evidence within thirty days. The single best check on close quality: reopens concentrate where discriminators were skipped, negatives went unrecorded, or the pattern reflex closed something the pattern did not cover. The trap: punishing reopens, which teaches analysts to argue against reopening instead of writing better closes. A reopen against a rubric-passing note is a detection lesson; against a thin note, a QA lesson.
Missed incidents the heaviest signal
Confirmed incidents that earlier passed through triage as a close. Rare, and each one outweighs a quarter of good numbers: every miss gets a blameless case review against the original record, asking which phase’s deliverable would have caught it. The trap: treating zero as the achievable target and shading post-incident timelines to protect it. The record discipline from the Documentation example exists exactly so these reviews have honest material.
Handoff rework quality of the packet
How often IR comes back with questions the packet should have answered, or re-runs investigation triage already did. Cheap to collect (ask IR to tag it) and directly actionable: recurring gaps point at a specific packet section going unfilled. The trap: measuring it without IR’s participation, which turns it into triage grading its own homework.
Time-in-phase diagnostic, not target
Where cases actually spend their clock. Long Uncover tails point at retrieval and coverage gaps (the three visibility questions); long Alert phases point at parsing and enrichment debt; time stalled before Escalation on cases that end P1 points at criteria being treated as end-of-arc checklists instead of tripwires. The trap: setting per-phase time targets, which produces phase-skipping. This one diagnoses; it is never a quota.
Pattern-library health the fast path’s engine
Three numbers: the share of queue volume closing at Level 0 against a documented entry (rising is good, if reopens stay flat), entries past their review date (should be zero), and tuning tickets filed and closed from false-positive findings (the false-positive-as-finding doctrine made countable). The trap: celebrating Level 0 share alone; paired with rising reopens it means the reflex is winning, not the library.
Close-note quality sampled, not census
The weekly QA sample scored against the five-check rubric. Trend matters more than level, and the score belongs to the team, not the individual: a falling trend is a training or workload signal. The trap: making it a per-analyst leaderboard, which converts an editing tool into a surveillance tool and kills the honesty the rubric depends on (check 3 requires admitting uncertainty).
The maturity model
Four levels, defined by what is true, not what is aspired to. Most teams discover they are at Level 1 in places and Level 0 in others; the model is per-practice, not a badge.
Level 0 · Ad hoc quality = who is on shift
Verdicts ride on individual instinct; close notes say “FP, known noise”; escalations are chat messages with a ticket link; what the last analyst learned leaves with them. Nothing is wrong with the people; there is simply no structure for the quality to accumulate in. The tell: two analysts giving different verdicts on the same alert, and there being no way to say which was right.
Level 1 · Structured the arc is in use
The phases structure real cases, close notes cite artifacts, escalations carry packets, and the vocabulary shows up in handoffs. This is where the site’s chapters plus Stage 3 training lands a team. The tell you are not past it: the structure lives in people’s discipline rather than the tooling, so it erodes under queue pressure and skips phases on busy days.
Level 2 · Measured the numbers exist
A baseline exists, the metrics above are reviewed on a cadence, the pattern library has an owner and current review dates, and QA samples close notes weekly. The templates live inside the case tool. The tell you are not past it: the metrics get reported but nothing changes because of them; the review is a meeting, not a steering input.
Level 3 · Improving the loop is closed
The metrics drive work: reopen clusters become detection tickets, time-in-phase tails become tooling investments, one real case a month becomes an exercise packet, and missed-incident reviews change the criteria or the coverage rather than just the write-up. Deviations that keep proving right go upstream as contributions. The tell: you can point at a detection rule, a tool purchase, and a training session that each exist because a metric moved.
What the SOC lead owns
The methodology gives analysts their part; these are the parts only the lead can carry, collected from where they appear across the site:
- The QA cadence: the weekly close-note sample against the rubric, run as revision practice in the open, never as a leaderboard.
- The pattern library: a named owner, enforced review dates, and the discipline that “I’ve seen this before” never substitutes for an entry (the ladder rules).
- The metrics review: quarterly, against the baseline, with each number paired to its quality check and at least one action item per review.
- The IR agreement: the pre-authorized immediate-actions list and the handoff expectations, negotiated in writing with the team that receives the escalations (protocols).
- The training arc: the sessions, the onboarding ramp, and the monthly conversion of one real case into a packet.
- Tabletops and post-incident reviews: exercising the escalation path before it is needed, and running blameless reviews whose findings land as tickets, not paragraphs.
- The timebox culture: protecting the depth ladder from throughput pressure, because the moment closes-per-shift becomes the implicit scoreboard, every metric above starts lying.
Key Takeaway
Adoption is a sequencing problem: pilot for evidence, baseline before change, train on local cases, reconcile tooling last, and then run the loop where metrics create work items. The methodology holds up the analyst’s side on every page of this site; the lead’s side is the seven duties above, and no rollout survives their absence.