Managed SOC for a grid operator: continuous security operations without an in-house security team
A regional energy supplier with around 350 employees runs eleven critical IT systems and two control centres. The IT team has six people. There is no coverage outside business hours. Security operations are outsourced as a managed service on Google SecOps, together with a documented reporting chain with named roles and deputies. The project plan allows four months until the reporting process has been practised, without an additional hire.
- Municipal utilities, grid operators and regional suppliers with their own IT operations but no shift model
- Organisations where information security is one task among many
- Organisations that have looked into building their own Security Operations Center and dropped the idea for staffing reasons
Why do security operations at utilities rarely fail because of technology?
A grid operator's reporting obligations follow from the German BSI Act as amended by the NIS2 Implementation Act, in force since 6 December 2025. Under Section 32 BSIG, a significant security incident must first be reported no later than 24 hours after becoming aware of it, followed by a notification with an initial assessment no later than 72 hours. Operators of critical facilities are also subject to obligations under the KRITIS Umbrella Act. Both frameworks are well known in-house.
In the starting situation, however, the detection of security-relevant events still ends when the working day ends. Reporting deadlines do not. They run from the moment of awareness, regardless of weekday and time of day.
A six-person IT team cannot staff continuous operations.
Building its own Security Operations Center fails because of headcount, not a lack of insight.
The second bottleneck is evidence.
Detection alone isn't enough. It has to be possible to show who decided what and when. That documentation doesn't happen on the side of day-to-day work.
Project profile
How are security operations set up?
Operations are outsourced, not built. Detection runs on Google SecOps and is connected to the critical IT systems. Wiz shows misconfigurations and attack paths that can actually be exploited instead of thousands of individual findings. Mandiant Threat Intelligence puts into context which attack patterns are currently targeting utilities.
The operator sets the regulatory framework. Security operations are set up so that the required evidence is produced during ongoing operations rather than having to be pieced together afterwards.
Define the scope
Capture the systems to be connected, the applicable deadlines, the evidence to be kept and the responsible supervisory authority. Two weeks.
Connect and go live
Connect the eleven critical systems to Google SecOps, Wiz agentless via the cloud environment. Six weeks.
Define the reporting chain
Decide who receives an alert outside business hours, who decides on it, who submits the report and how deputies are arranged. Plus templates for the deadlines that apply in-house.
Rehearse an incident
A tabletop exercise from the attacker's perspective before production operations start.
Take over operations
Continuous monitoring, a monthly report for management and the supervisory board, quarterly fine-tuning of the detection rules.
What technology is behind it?
Google SecOps
Detection and analysis across all connected systems
Wiz
Visibility of misconfigurations and exploitable attack paths
Mandiant Threat Intelligence
Current attack patterns targeting utilities
Managed Security Operations by GMinds
Continuous operations that the operator doesn't have to staff itself
Operations and data storage take place in German or European regions. Only named individuals on the provider side have access; every access is logged, and the logs stay with the operator. Security data is not used to train models. If the collaboration ends, detection rules and history are handed over to the operator.
How can progress be measured after four months?
Starting point
- No central detection across a heterogeneous IT landscape
- IT team of six, no coverage outside business hours
- Reporting deadlines run from awareness, detection ends when the working day does
- Evidence of who decided what and when isn't produced in day-to-day work
Measures after four months
- Every reporting deadline is backed by a process with named roles and fixed times.
- The number of security-relevant events per month is known, as is the share that required a human decision. In the starting situation, neither is known because nobody is looking.
- Reporting to management and the supervisory board fits on one page instead of a binder.
Find out in 30 minutes what your security operations could look like
- Assessment of your starting point
- Rough estimate of scope and duration
- Next steps
