Getting More From Your SOC: What It Should Do for Your Officers and Your Managers

Ashlee Cervantes Thomas, Guardian Alliance, CALSAGA Associate Member

Many security companies that have a Security Operations Center (SOC) use only part of its potential.

Some built their own dispatch center. Some send after-hours calls to an outside operations center. Others hand a supervisor the on-call phone and call that a SOC. In all three cases, the pattern is often the same. The SOC answers, takes a message, and passes the call to a manager. The manager still makes the decision, still makes the follow-up call, and still documents what happened.

That setup costs real money but delivers only a fraction of the value a SOC should provide.

For security company owners, the real value of a SOC isn’t measured by the number of calls it answers. It’s measured by the decisions it supports, the problems it resolves, and the operational burden it removes from the people responsible for running the business.

A well-utilized SOC should function as an extension of your operations team, supporting officers in the field, providing management with actionable information, and identifying potential problems before they escalate.

Getting there depends less on who staffs the SOC and more on how your company uses it.

What a SOC should handle for your officers

Your officers need one thing from operations before anything else: someone who answers.

An officer who calls three times at 3 a.m. and reaches voicemail learns to stop calling. From then on, they make decisions alone, and you find out what they decided after the fact.

A SOC should be the first call for every officer, on every post, for:

• Call-offs and open shifts. The SOC logs the call-off, works your coverage list in the order you establish, and escalates to a supervisor when additional decisions or resources are needed.
• Post information. Site contacts, access instructions, and post orders should be available through your operational platform so no one wakes a manager for a gate code.
• Relief and breaks. Coordinating who is relieving an officer, when relief is expected, and what happens when coverage is delayed.
• Welfare checks. Conducting scheduled check-ins for officers working alone, with documented procedures for missed contacts.
• Live incidents. Allowing the officer to remain focused on the situation while the SOC coordinates emergency notifications, contacts designated personnel, and documents critical timestamps according to established protocols.
• Everyday questions. Schedules, time-off requests, and equipment issues can be documented and routed to the appropriate person without requiring an immediate management response.

None of this is particularly complicated. Yet these are often the same reasons officers call their manager’s cell phone today.

There is also an employee experience component worth considering.

In Trackforce’s 2025 benchmark survey of more than 300 security professionals, over 40% of security providers identified employee turnover as their biggest challenge, alongside pressure from rising wages and non-billable overtime.

A SOC cannot solve compensation challenges or eliminate turnover. But providing officers with consistent, dependable operational support is something security companies can control.

Officers who know someone will answer, provide direction, and follow through are better positioned to do their jobs confidently.

What a SOC should handle for your management team

For managers, the first benefit is obvious: fewer calls at night.

The bigger benefit is what the SOC records while handling those calls.

When interactions are consistently documented in a centralized system, that information begins to reveal patterns no individual manager can easily identify from a cell phone.

Over time, SOC records can help answer important operational questions:

• Which sites generate the most call-offs, and on which days?
• Which officers are consistently late to post?
• Which posts repeatedly miss scheduled welfare check-ins?
• Which clients contact operations most frequently, and why?
• How long do open shifts remain unfilled?

That is the information managers need to address a problematic post before the client raises concerns, improve next month’s schedule, and walk into a contract renewal with facts rather than impressions.

The SOC should also replace the fragmented overnight text thread.

Instead of waking up to twenty separate messages, managers should receive one organized summary outlining what happened, who was notified, what remains unresolved, and which decisions require attention.

Managers begin their day knowing where operations stand rather than spending the first hour reconstructing what happened overnight.

Moving beyond reactive dispatch

Answering calls and documenting incidents are essential functions, but a mature SOC should do more than respond when something goes wrong.

There is an important distinction between reactive support and proactive operational oversight.

Reactive support begins when someone makes a call. An officer reports an issue, a client requests assistance, or an incident requires escalation.

Proactive oversight looks for operational exceptions before someone needs to report them.

Depending on the services and systems available, that might include identifying missed check-ins, reviewing incomplete patrol activity, monitoring camera alerts, verifying shift coverage, or flagging recurring problems at particular sites.

Consider an officer who misses a scheduled welfare check. A reactive operation may not discover the issue until someone calls. A proactive SOC identifies the missed contact, initiates the established follow-up procedure, and escalates when necessary.

The objective isn’t to replace supervisors or remove their judgment. It’s to give them another layer of visibility and support.

A SOC shouldn’t simply document what went wrong. It should help operators recognize when something may be going wrong.

That shift from answering calls to actively supporting operations is where a SOC can become a meaningful operational asset.

Teach officers to use it, and keep managers from going around it

A SOC only works if people use it.

That requires two consistent habits: one in the field and one in management.

In the field, officers need to know the SOC number and understand when they should call. Include the number in post orders, onboarding materials, and operational communications. Establish clear expectations that the SOC is the first point of contact for call-offs, post questions, relief issues, and incidents.

Consider having the SOC contact each new officer during their first shift. The goal is to make the first interaction a familiar introduction rather than an emergency.

In the office, managers have to resist the temptation to bypass the system.

This is harder than it sounds.

A manager who responds to a call-off text at 9 p.m. is trying to be helpful. But if that information never reaches the SOC, the open shift may not be properly documented, other operational personnel may remain unaware, and the following month’s reporting becomes less reliable.

The rule should be straightforward: officers contact the SOC, and the SOC brings decisions to managers when appropriate.

Managers still make decisions requiring their authority and experience. They simply stop handling every routine operational call themselves.

Consistency is what makes the system work.

Three California obligations a SOC can help you manage

For California security providers, a well-organized SOC can also strengthen the documentation and coordination processes that support regulatory compliance.

A SOC does not replace management’s compliance responsibilities, employment counsel, or required reporting procedures. It can, however, help ensure important information is captured and routed promptly.

Rest breaks. California law generally requires employers to relieve employees of all work-related duties during required rest periods, including the obligation to remain on call. The California Supreme Court reinforced this principle in Augustus v. ABM Security Services, a case involving security officers.

For single-officer posts, arranging appropriate relief can be an operational challenge. A SOC can help coordinate relief assignments, track scheduled breaks, and document situations where relief is delayed or unavailable. Employers must still establish lawful break procedures and ensure that qualifying rest periods are actually provided.

Workplace violence documentation. Since July 1, 2024, California’s SB 553 has required most covered employers to maintain a written Workplace Violence Prevention Plan and document workplace violence incidents in a violent incident log. Required information includes details such as the date, time, location, and nature of the incident.

When officers report incidents through a centralized SOC, operators can capture initial details, preserve timestamps, and promptly notify the individuals responsible for completing required records. The SOC’s initial report can support the process, but employers must ensure their formal logs and investigations satisfy applicable requirements.

BSIS incident reporting. California’s Bureau of Security and Investigative Services requires Private Patrol Operators and security officers to report certain on-duty incidents involving physical altercations, firearm discharges or use, or deadly weapons within seven business days.

A SOC can help by flagging potentially reportable incidents and directing them immediately to the designated person responsible for evaluating and submitting the required report.

The reporting deadline begins with the incident, not when someone in the office discovers it.

In each of these examples, the value of a SOC comes from consistency: information is documented, the appropriate personnel are notified, and operational issues are less likely to disappear into individual phone calls or text messages.

Where to start

You don’t necessarily need new software, more personnel, or an entirely different operations center to get more value from your SOC.

Start by evaluating how your current system is being used.

Are officers consistently contacting the SOC first? Are routine operational issues being resolved without unnecessary management involvement? Are managers receiving useful information, or simply a record of calls answered? Is your SOC identifying potential issues proactively, or only responding after someone reports a problem?

The answers will tell you whether your SOC is functioning as a communications center or as a true extension of your operations team.

At Guardian Alliance SOC, we approach these questions from the perspective of security company operators. Built by owners who understand the challenges of managing officers, clients, and around-the-clock operations, our focus is on helping security providers establish dependable communication, consistent oversight, and stronger operational accountability.

Whether you operate an internal SOC or partner with an outside provider, the principle remains the same:

Your SOC should do more than answer the phone. It should help you run a better security operation.

Learn more about Guardian Alliance SOC at guardian-soc.com.

Ashlee Cervantes Thomas, MBA, is CEO of Guardian Protection Force, Inc., a California-based private security company established in 2010, and Co-Founder and CEO of Guardian Alliance SOC. With more than 15 years of experience in private security operations, she brings an operator’s perspective to modernizing security communications, incident response, and operational oversight. She holds an MBA from the University of California, Davis, and proudly serves as Vice President of CALSAGA.

Sources

• Trackforce, 2025 Physical Security Operations Benchmark Report, Business Wire, October 2025.
• California Supreme Court, Augustus v. ABM Security Services, Inc., December 22, 2016.
• California Division of Occupational Safety and Health (Cal/OSHA), Workplace Violence Prevention for General Industry.
• California Bureau of Security and Investigative Services (BSIS), Submitting Incident Reports and Notice of Violent Acts.