In this article
What a board needs to guarantee is not that it “has a SOC”. It is that every relevant alert reaches someone competent, within hours that match the risk, and that this person acts. For companies with 10 to 200 workstations, this is achieved with a contracted NOC — availability monitoring with alerting — and with the essential security functions delivered as a managed service. A dedicated security team on permanent watch is almost always disproportionate.
Who notices the problem at 10 pm on a Saturday?
This is the question that separates a monitored company from one that merely “has antivirus”. A disk filling up, a failed backup, an admin account used from another country: none of these events waits for Monday. If nobody receives the warning, the problem grows until it becomes downtime or a data leak.
The context has worsened. Figures from Portugal’s National Cybersecurity Centre presented to Parliament show that CERT.PT handled 3,864 incidents in 2025, a 40% rise on 2024. Nearly half began with the human factor: an email, SMS or chat message that persuades someone to open a fake link or reveal a password.
Then there is the legal framework. Entities covered by NIS2 have 24 hours to report a significant incident, which presupposes detecting it first. We summarise the obligations in what NIS2 requires of an SME.
What does a NOC watch, and what does a SOC watch?
The NOC — Network Operations Center — answers “are the systems working?”. The SOC — Security Operations Center — answers “is someone trying to get in, or have they already?”. Think of a hotel: the NOC is the maintenance team that sees on the technical panel that a lift has stopped or the air conditioning has failed; the SOC is the security team that sees on a camera someone trying to open a service door in the early hours.
| Dimension | NOC: availability | SOC: threats |
|---|---|---|
| Core question | Are the systems responding as they should? | Is there an intrusion under way or already completed? |
| What is monitored | Internet links, servers, storage, memory, backups, firewalls, access points | Login attempts, accounts with abnormal use, malicious software, unusual traffic |
| Typical alert | Server storage at 95%; last night’s backup unsuccessful | Finance director’s session opened from abroad |
| Expected action | Prevent downtime: clear disk space, replace the disk, rerun the backup | Stop the attack: suspend the account, isolate the workstation, establish what happened |
| Cost of failure | Hours without working | Data theft, fraud, encrypted files, legal duties |
The boundary is blurred. A server that suddenly slows down may have a failing disk or ransomware encrypting data. That is why, in an SME, it pays to have a single team looking at availability and security rather than two providers with no context of each other.
Does an SME really need a dedicated SOC?
In most cases, no. A SOC in the classic sense — analysts on permanent watch, its own event correlation platform — is sized for large organisations. For 10 to 200 workstations, what protects the business is five capabilities contracted from an MSP:
- Managed endpoint security Protection on workstations and servers is installed, maintained and followed up by engineers who interpret the alerts, rather than being left to run on its own.
- Managed firewall Policies reviewed, firmware up to date and suspicious events forwarded to the team.
- MFA everywhere Stolen credentials are the most common way in; we detail the implementation in how to make multi-factor authentication work across the company.
- Documented response plan Defines who isolates a device, who informs the board and who reports to the authorities.
- Agreed coverage window Business hours only, or also nights, weekends and public holidays, according to the business’s exposure.
There are exceptions. Entities within the scope of NIS2, organisations holding sensitive clinical or financial data and operations that never stop may justify a more extensive SOC service. That conclusion should come from a risk analysis of the company, not from a product table.
How to assess a monitoring proposal
- Scope — demand the inventory of what is monitored: servers, workstations, firewalls, Wi-Fi, backups, Microsoft 365.
- Recipient — does the alert go to an engineer, to a ticket queue or to a forgotten mailbox?
- Hours — monitoring during office hours only leaves the weekend uncovered.
- Action — is the intervention included, or do you only receive a warning to resolve internally?
- Proof — which reports do you receive, and how often? Without a report, there is no evidence of service.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
What is included in the IT Unlimited plans?
In every IT Unlimited plan from DataRoad - IT Services and Consulting, security is part of the service: monitoring with alerting, managed firewalls and probes, protected and supervised endpoints, two-factor authentication and maintenance of the cybersecurity platforms. Every alert is handled by our engineering team through remote, on-site or telephone support, with immediate response times.
| Plan | Monitoring and support window |
|---|---|
| Essential | Working days during business hours; remote and telephone support |
| Premium | Working days during business hours; unlimited on-site assistance |
| Premium 365 | 24/7 monitoring and support in Premium 365, including nights, weekends and public holidays |
There is no ambiguity: round-the-clock coverage is exclusive to the Premium 365 plan. To see the difference between anticipating failures and firefighting, read why proactive monitoring costs less than reactive support.
How does it work with real clients?
Ventask has worked with DataRoad since 2016 and has more than 350 workstations. A single team administers the corporate firewalls, switches and access points, deploys and manages endpoint security, maintains the cybersecurity platforms and provides proactive 24/7 monitoring with alerting under Premium 365. When the firewall raises an alert, whoever analyses it knows the topology, the servers and the people — and wastes no time opening requests with a third party.
On a different scale, Boost Portugal has an annual contract with remote monitoring of all systems, alarms and availability reports.
Frequently asked questions
How do a NOC and a SOC differ?
The NOC tracks availability (internet, servers, storage, backups, network) and the SOC tracks threats (unauthorised access, compromised accounts, malware, anomalous traffic). In an SME, the most effective approach is for the same team to cover both.
Should a company with 30 workstations hire a SOC?
As a rule, not a dedicated SOC. It needs managed endpoints and firewall, MFA, a written response plan and a coverage window proportionate to the risk.
Does DataRoad monitor 24/7?
Only in the IT Unlimited Premium 365 plan, which includes nights, weekends and public holidays. Essential and Premium operate during business hours.
With monitoring in place, is antivirus still needed?
Yes. The protection installed on workstations remains essential; monitoring ensures that the alerts it and the firewall generate are seen and acted upon.
Next step: monitoring assessment in 7 working days
We map what is monitored today, the gaps, who receives each alert and at what hours, and present a no-obligation proposal sized to your company’s risk. Discover our NOC and infrastructure monitoring service and our cybersecurity and managed firewall offering.
More than 10 workstations · support contract · remote, on-site and telephone support.
Call +351 211 459 950* or write to sales@dataroad.pt.
*Call to a Portuguese landline.
