SOC providers for PCI DSS requirements

Match monitoring, response and evidence delivery to the payment environment and responsibilities in your assessment scope.

Alert Logic

Alert Logic's MDR analysts investigate cloud and hybrid alerts, then escalate verified incidents with evidence and recommended actions.

You still own Containment, remediation, connected tools and approval of response workflows

What they do Investigate and advise MDR

eSentire

eSentire MDR investigates and contains threats through supported tools under agreed response rules.

You still own EDR licensing, tool access, response permissions and recovery outside agreed incident support

What they do Contain threats MDR
Price $17/user/mo + $2,500/year

Adlumin MDR by N-able

Adlumin MDR by N-able investigates and contains threats through a shared XDR and SIEM platform. Your team maintains controls and handles work outside the package.

You still own Connected tools, response permissions, escalation rules and work outside the package

What they do Co-manage the SOC MDR
About this list

Identify the payment systems and supporting services that need monitoring. Ask which logs are collected, what analysts review and how missing telemetry is detected.

Review relevant provider attestations and the responsibility split with your assessment team. Set retention, evidence access and incident handoff requirements for your deployment rather than assuming a category label covers them.

Questions

What provider documents should we request?
Ask for relevant current attestations, their service scope and a responsibility matrix. Confirm with your assessor which evidence applies to the proposed engagement.
Which operational details belong in the contract?
Specify covered systems, log review, retention, access to evidence, alert escalation and response actions. Identify any separately priced reporting or assessment support.