Use it when
Use this list when a framework requirement affects your SOC provider shortlist.
Compliance need
ISO 27001-Certified SOC Providers
Providers indicating ISO 27001 support. Confirm evidence, retention, data location, and reporting.
19 providers
Arctic Wolf
24/7 MDR through Arctic Wolf's Aurora platform, Concierge Security Team guidance and supported Active Response containment workflows
SMB / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price AWS Marketplace public offer plus quote-based tiers
CrowdStrike Falcon Complete
24/7 triage, managed threat hunting and remote containment by CrowdStrike on the Falcon platform
Enterprise / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price ~$25-45/endpoint/month*
Red Canary
24/7 MDR that investigates supported security telemetry and can run response playbooks through existing tools
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based. Public reviews mention roughly $100/device/year*
Sophos MDR
24/7 managed detection, investigation, threat hunting and response through Sophos Central and supported integrations
SMB / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price AWS Marketplace: $239.64/user/year and $390.72/server/year*
Adlumin
A co-managed security operations platform that combines SIEM-style log collection, UEBA, SOAR automation, compliance reporting and 24/7 MDR support
SMB / Mid-Market · Endpoints
Service MDR
Handles Co-manage the SOC
Price Quote-based
Bitdefender MDR
24/7 SOC investigation, threat hunting, reporting and pre-approved containment through Bitdefender GravityZone
SMB / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price Quote-based with no official public MDR list price found
Bridewell Security Operations Center
Hybrid or fully outsourced SOC operation with 24/7 monitoring, alert investigation, threat hunting, threat intelligence, SIEM and SOAR enhancement, incident response leadership and detection improvement across agreed environments.
Mid-Market / Enterprise · Endpoints
Service SOCaaS
Handles Run the SOC
Price Public G-Cloud references by user, server and scope
BT Managed Sentinel
24x7 managed Microsoft Sentinel monitoring, rule tuning, SOC investigation, incident reporting and buyer guidance
Enterprise / Mid-Market · Network
Service MSSP
Handles Investigate and advise
Price Public G-Cloud price from £6,275 per instance
Darktrace Managed Detection and Response
24/7 SOC monitoring of the buyer's Darktrace environment, alert triage, investigations, containment-action escalation, analyst questions, monthly service reports, service-ready checks and optimization reviews.
Mid-Market / Enterprise · Network
Service MDR
Handles Co-manage the SOC
Price Quote-based; AWS Marketplace supports private offers but does not expose a reliable public service rate.
Datadog Cloud SIEM
Cloud SIEM detection rules, security signals, notifications, cases, dashboards, threat intelligence context and workflow hooks inside Datadog
Enterprise / Mid-Market · Cloud Workloads
Service SOCaaS
Handles Monitor and notify
Price Published from $5 per 1M analyzed events/month
eSentire
24/7 MDR monitoring, threat hunting, alert validation, investigation, multi-signal correlation, containment actions, incident handling and reporting through eSentire Atlas XDR and eSentire's SOC team.
SMB / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price Quote-based Atlas Essentials, Advanced and Complete MDR packages
Expel MDR
24/7 SOC monitoring, analyst investigation, Workbench visibility, cross-product correlation, remediation recommendations and pre-approved auto-remediation through supported tools.
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based Starter, Select and Premium MDR packages
Field Effect MDR
24/7 MDR over Field Effect's endpoint, cloud and network telemetry, with AROs and policy-bound active response
SMB / MSP/MSSP · Endpoints
Service MDR
Handles Contain threats
Price Quote-based per-user pricing
Microsoft Defender Experts for Hunting
24/7/365 Microsoft-managed threat hunting across eligible Defender telemetry, Defender Experts Notifications, Ask Defender Experts credits, reporting and remediation guidance for an existing SOC.
Mid-Market / Enterprise · Endpoints
Service XDR
Handles Investigate and advise
Price Quote-based Microsoft commercial licensing; no public standalone list price found.
Microsoft Defender Experts for XDR
24/7 Microsoft-managed triage, investigation, proactive hunting, managed response recommendations and scoped remediation actions for eligible Microsoft Defender XDR incidents.
Mid-Market / Enterprise · Endpoints
Service XDR
Handles Contain threats
Price Microsoft sales-led pricing with a Defender Experts Suite 1,500-seat minimum in Product Terms
Netsurion Managed Open XDR
Co-managed Open XDR with managed SIEM, 24/7 SOC monitoring, workflow automation, threat hunting, log retention, compliance reporting and package-dependent endpoint, vulnerability and incident-support options.
SMB / Mid-Market · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based, with pay-as-you-grow packaging referenced for MSP buyers
Proficio ProSOC MDR
24/7 SOC monitoring, analyst investigation, hosted or customer-owned SIEM operations, threat hunting, case management, guided remediation and optional Active Defense containment across supported tools.
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based direct, partner or marketplace private offer
Rapid7 Managed Threat Complete
24/7 SOC monitoring, alert validation, investigation, exposure-informed prioritization, threat hunting, incident-response support, Rapid7 SIEM visibility, unlimited log ingestion in published packages, 13-month retention and configured Active Response containment.
Enterprise / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price AWS Marketplace lists Managed Threat Complete Essential at $73,000 for a 12-month contract starting at 300 assets; Rapid7 also supports private offers and custom quotes.
ReliaQuest GreyMatter
GreyMatter connects to enterprise security tools, normalizes alerts, supports investigation and hunting, runs approved response playbooks and gives the buyer a shared operating surface with ReliaQuest analysts and engineers.
Enterprise / Mid-Market · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price AWS Marketplace lists a 12-month GreyMatter SIEM Integration Plus package at $226,000*
How to use this list
Do not assume
Compliance support is not the same as audit readiness for your exact environment, evidence needs, or data location.
Ask before shortlisting
- Ask for the actual evidence package, not just the compliance logo.
- Confirm data processing locations, retention, and audit-ready reporting.
- Check whether the provider can support your framework without a custom services project.
Category background
These SOC providers support ISO 27001 compliance — the globally recognized standard for information security management. ISO 27001 certification is increasingly required by enterprise customers, partners, and regulators worldwide, making it a critical consideration when selecting a SOC provider.
ISO 27001 and Security Operations
ISO 27001’s Annex A includes specific controls for security monitoring, incident management, and operational security that map directly to SOC provider capabilities. A provider that understands ISO 27001 can help you demonstrate compliance with controls related to event logging and monitoring, malware protection, network security, vulnerability management, and information security incident management. Compliance-mapped reporting from your SOC provider becomes valuable evidence during ISO 27001 audits and surveillance assessments.
Evaluating ISO 27001 Support
When evaluating SOC providers for ISO 27001 support, look for providers that are themselves ISO 27001 certified, can map their monitoring capabilities to specific Annex A controls, provide compliance-ready reporting for audit evidence, and understand the continuous improvement requirements of the standard. The best providers help you identify gaps in your ISMS through their monitoring data and incident trend analysis.
Questions
What is ISO 27001 and why does it matter for SOC providers?
ISO 27001 is the international standard for information security management systems (ISMS). It provides a systematic approach to managing sensitive information through risk assessment, security controls, and continuous improvement. For SOC providers, ISO 27001 is relevant in two ways — the provider's own operations should be ISO 27001 certified (demonstrating their security maturity), and they should support your organization's ISO 27001 compliance through security monitoring and incident management aligned to Annex A controls.
Which ISO 27001 Annex A controls do SOC providers cover?
SOC providers primarily support Annex A controls related to operations security (A.12), communications security (A.13), and information security incident management (A.16). This includes monitoring of information processing facilities, protection against malware, event logging and monitoring, network security management, and incident response procedures. Some providers also support access control monitoring (A.9) and supplier relationship security (A.15).
Should my SOC provider be ISO 27001 certified?
While not strictly required, choosing an ISO 27001-certified SOC provider gives you assurance that their operations meet international security standards. It also simplifies your own certification or recertification, since auditors will look favorably on suppliers that maintain recognized certifications. Many enterprise-focused SOC providers hold ISO 27001 certification for their SOC operations.