OPERATE · Security Operations Build–Operate–Transfer
Begin Managed. End Sovereign.
DAAKYI builds and runs a security operations capability for your institution, then transfers it: people, process and technology.
- A sovereign security operations capability
- Trained in-country teams
- Documented, auditable deliverables
- 1Assess and Scope
- 2Design and Build
- 3Operate Jointly
- 4Shift Accountability
- 5Own and Improve
Executive Summary
- 01Build-operate-transfer treats ownership as the deliverable, so every phase is judged by what the institution can do unaided.
- 02Joint shifts, versioned detection content, and gated handoffs move skills across in stages.
- 03Transfer is complete only when local teams can detect, investigate, repair, and govern the SOC.
The Challenge
National and sector institutions need operational security capability now, but long‑term sovereignty requires the capability to stay in‑country.
Building a SOC from scratch takes time, scarce skills and design experience most institutions do not yet have.
The DAAKYI Approach
DAAKYI designs and builds the SOC, operates it while developing your team, and transfers ownership through a planned handover.
Knowledge transfer is built into every stage, not left to the end.
- 01
SOC design and build
- 02
Operation with joint teams
- 03
Capability development and mentoring
- 04
Planned transfer of ownership
In Depth
How the Discipline Works
Build: Design Before Technology
A build-operate-transfer program starts with design decisions, not tool purchases. The institution and provider define the SOC's mission, the constituency it serves, the log sources it must see, and the escalation paths into leadership and regulators. Use cases are mapped to adversary behavior, for example against MITRE ATT&CK tactics, so detection effort follows real risk. Staffing models, shift patterns, and role descriptions are drafted early, because the transfer team must be recruited while the platform is still being configured. Hosting location and data handling rules are settled at this stage, since moving telemetry later is costly and politically sensitive.
Operate: Joint Shifts and Shadowing
During the operate phase, provider analysts run triage, investigation, and escalation while institution staff sit beside them. Early on, the provider leads and the institution observes. Over time the balance shifts: institution analysts take first-line alerts, then investigations, then incident command. Each handoff is gated by evidence, such as quality of case notes and correct use of runbooks, not by calendar dates. Detection content is tuned continuously, and every tuning decision is explained to the local team. Incident handling follows a documented lifecycle such as NIST SP 800-61, so reporting duties to authorities are met from the first day.
Transfer: Handing Over Ownership Safely
Transfer is a controlled change of accountability, not a handshake at contract end. The institution first runs the SOC under provider supervision, then the provider steps back to an advisory role. Administrative rights to the platform, detection rules, case records, and integrations move to named institution owners. Credentials are rotated and third-party access is removed or formalized. A readiness review tests whether the team can handle a realistic incident without help. Governance moves too: metrics, risk reporting, and budget ownership pass to institution leaders. Only then is the SOC declared sovereign, with any continuing support defined as a separate, explicit scope.
A SOC is transferred only when the institution can detect, investigate, and repair it without the provider in the room.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| SOC Development | Design, build and transfer. | – | – | OPERATE stage | Build-Operate-Transfer, Capability Development |
| Capacity Building | For regulators and operators. | – | – | OPERATE stage | Build-Operate-Transfer, Capability Development |
| Operational Runbooks | Processes documented for handover. | – | – | OPERATE stage | Build-Operate-Transfer, Capability Development |
| Governance and Reporting | Models your institution keeps. | – | – | OPERATE stage | Build-Operate-Transfer, Capability Development |
SOC Development
Design, build and transfer.
- Stage
- OPERATE
- Delivered Through
- Build-Operate-Transfer, Capability Development
Capacity Building
For regulators and operators.
- Stage
- OPERATE
- Delivered Through
- Build-Operate-Transfer, Capability Development
Operational Runbooks
Processes documented for handover.
- Stage
- OPERATE
- Delivered Through
- Build-Operate-Transfer, Capability Development
Governance and Reporting
Models your institution keeps.
- Stage
- OPERATE
- Delivered Through
- Build-Operate-Transfer, Capability Development
How It Works
From build to ownership
Stage 1 · Methodology stages 1–5
Build
Discovery, posture assessment and SOC design, then technology implementation, integration and assurance testing before go-live.
Stage 2 · Methodology stages 6–7
Operate
DAAKYI runs 24/7 operations under documented runbooks while your analysts work alongside ours and are trained and mentored.
Stage 3 · Methodology stage 8
Transfer
A planned handover of people, process and technology, with maturity reviews and client enablement until your team operates independently.
What your institution owns at the end
- The SOC design, technology and configuration
- Runbooks, playbooks and detection use cases
- Trained analysts and team leads
- Governance, reporting and case-management model
- Documented, auditable deliverables from every stage
Knowledge‑Transfer Commitments
- Knowledge transfer built into every program we deliver.
- Every stage produces documented, auditable deliverables.
- Capability Development: training, certification and mentoring programs.
- Accredited professional certification through PECB via DAAKYI Cyber Academy.
Methodology
The Method, Step by Step
- 1
Assess and Scope
Establish the constituency, critical services, regulatory duties, existing logging, and staff skills. Document gaps against a chosen control framework. Agree success criteria for ownership, including which functions the institution must perform unaided at transfer. These criteria later serve as the exit tests for the whole program.
- 2
Design and Build
Specify the operating model, tiering, data pipeline, and case management workflow. Onboard priority log sources first, then expand. Write detection use cases mapped to adversary techniques and test each one with simulated activity. Draft runbooks while building, so documentation reflects how the SOC actually behaves rather than how it was planned.
- 3
Operate Jointly
Run live monitoring with mixed teams. Provider staff hold accountability while institution staff rotate through every role. Track case quality, false-positive rates, and escalation accuracy. Hold regular reviews where the institution challenges detection choices. Record each lesson in the runbooks so knowledge outlives individuals.
- 4
Shift Accountability
Move functions one at a time, starting with monitoring and triage. Each function passes a readiness test using live or simulated cases. After a function transfers, the provider reviews its output instead of producing it. Gaps found in testing return to the training plan, not to the provider's workload.
- 5
Own and Improve
Complete the formal handover of platform administration, content, records, and governance. Run an exercise that tests escalation to executives and regulators. Set a cadence for detection reviews, framework alignment, and staffing. The institution then owns the improvement cycle, including budget and priorities.
Operating Model
Delivered from the OPERATE Pillar
Pillar position
OPERATE
Security Operations & Managed Resilience
Engagement model
Build‑Operate‑Transfer
DAAKYI builds and runs the capability, then transfers it.
Best for · National and sector SOCs seeking ownership
Engagement model
Capability Development
Training, certification and mentoring programs.
Best for · Regulators and operators growing talent
Threat Scenarios
What It Looks Like in Practice
Credential Theft Through Phishing
How It Shows Up
Sign-ins appear from unfamiliar locations, followed by new mailbox forwarding rules.
Response
Joint analysts confirm scope and reset access. The local lead owns the case record, and the new detection enters the runbook.
Silent Log Source Failure
How It Shows Up
A critical system stops sending logs and no alert fires.
Response
Ingestion health monitoring flags the gap. A local engineer repairs the collector under provider review.
Ransomware Precursor Activity
How It Shows Up
Remote administration tools and bulk file access appear on servers outside business hours.
Response
Containment follows the runbook, and escalation reaches executives and the sector regulator.
Analyst Attrition Mid‑Program
How It Shows Up
A trained analyst leaves and shift coverage thins.
Response
Documented runbooks and cross-training let a new hire reach competence without losing detection quality.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Credential Theft Through Phishing | Sign-ins appear from unfamiliar locations, followed by new mailbox forwarding rules. | Joint analysts confirm scope and reset access. The local lead owns the case record, and the new detection enters the runbook. |
| Silent Log Source Failure | A critical system stops sending logs and no alert fires. | Ingestion health monitoring flags the gap. A local engineer repairs the collector under provider review. |
| Ransomware Precursor Activity | Remote administration tools and bulk file access appear on servers outside business hours. | Containment follows the runbook, and escalation reaches executives and the sector regulator. |
| Analyst Attrition Mid‑Program | A trained analyst leaves and shift coverage thins. | Documented runbooks and cross-training let a new hire reach competence without losing detection quality. |
Outcomes
What Your Institution Gains
- A sovereign security operations capability
- Trained in-country teams
- Documented, auditable deliverables
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| SOC Operating Model | Defines mission, tiers, shifts, and escalation so the institution knows what it is taking over. |
| Detection Catalog | Lists every rule with its purpose, data source, ATT&CK mapping, and test case. |
| Runbook Library | Gives analysts step-by-step procedures for recurring alert types and incident classes. |
| Competency Matrix | Records which analysts can perform which functions unaided. |
| Handover Acceptance File | Evidences readiness tests, access transfers, and formal sign-off of ownership. |
| Role | Responsibility |
|---|---|
| SOC Owner (Institution Executive) | Holds accountability for budget, risk decisions, and the final acceptance of transfer. |
| SOC Manager (Institution) | Leads the local team and progressively takes control of daily operations. |
| Detection Engineer (Provider, Then Institution) | Builds and tunes rules, then trains local engineers to maintain them. |
| Transition Lead (Provider) | Plans each handoff gate and verifies evidence before accountability moves. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Dependent
The provider performs all monitoring and response. Local staff observe and learn the tooling.
Stage 2
Co‑Operating
Local analysts handle first-line alerts with provider review of every escalation.
Stage 3
Supervised Ownership
The institution runs the SOC, and the provider audits quality and advises on complex incidents.
Stage 4
Sovereign
The institution operates, tunes, and governs the SOC independently and sets its own improvement priorities.
Frameworks and Regulation
The Standards That Shape This Work
NIST CSF 2.0
Its six functions (Govern, Identify, Protect, Detect, Respond, Recover) give a shared structure for scoping SOC responsibilities and for measuring handover readiness.
ISO/IEC 27001:2022
Annex A has 93 controls in four themes, and monitoring, incident management, and logging controls shape SOC procedures. ISO/IEC 27002:2022 offers implementation guidance.
MITRE ATT&CK Enterprise
Its 14 tactics, with techniques and sub-techniques, let teams map detections to adversary behavior and show coverage gaps.
Ghana Cybersecurity Act, 2020 (Act 1038)
It established the Cyber Security Authority and provides for Critical Information Infrastructure protection and incident reporting, which a national or sector SOC must support.
Buyer Guidance
Choosing the Right Provider
What to look for
- Handoff gates tied to demonstrated skill, not elapsed time.
- Detection content delivered as documented, exportable, version-controlled assets.
- A transfer plan that covers access, licenses, data, and governance, not only training.
- Clear separation between transferred ownership and any optional continuing support.
Questions to ask a provider
- Which functions will our staff perform unaided at each gate, and how will you test that?
- Can we export all detection rules, case records, and configurations in usable formats?
- How do you handle analyst turnover on our side during the program?
- What exactly is excluded from transfer, and why?
Regulatory & Industry Context
The Obligations This Service Supports
BOT programs support national cybersecurity strategies, sector CERT development and critical-infrastructure obligations under Ghana's Act 1038.
Frameworks DAAKYI helps clients implement
- Ghana Act 1038
- NIST CSF
- ISO/IEC 27001
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Framework and regulatory alignment
- Ghana Act 1038
- NIST CSF
- ISO/IEC 27001
BOT programs support national cybersecurity strategies, sector CERT development and critical-infrastructure obligations under Ghana's Act 1038.
Architecture reference
How Security Operations Build–Operate–Transfer Works: Build → Operate → Transfer → Own.
DAAKYI designs and builds the SOC, operates it while developing your team, and transfers ownership through a planned handover.
Designing the Telemetry Pipeline for Transfer
A transferable SOC depends on a pipeline the institution can operate. Collect identity, endpoint, network, cloud, and application logs through documented collectors, and normalize them to a common schema so rules survive tool changes. Define retention by purpose: short hot storage for search, longer cold storage for investigations and legal needs. Monitor ingestion health, because a silent log source is a blind spot, and alert when expected volume drops. Store detection rules as versioned code with peer review and test cases. That practice lets institution engineers inherit content with its history, rather than a black box of undocumented alerts.
Measuring Readiness to Take Over
Handover readiness should be measured, not assumed. Use detection coverage mapped to ATT&CK techniques relevant to the institution's threat profile, and test it with adversary emulation. Track mean time to detect and mean time to respond as trends, comparing joint-team and institution-only periods. Review case files for completeness: evidence, timeline, scoping, and containment rationale. Run tabletop exercises that include legal, communications, and regulators. Check that analysts can modify rules, repair a failed collector, and restore the platform from backup. A SOC the institution cannot repair is not yet owned. Record every result in the handover file.
Glossary
Key Terms
- Handoff Gate
- An evidence-based checkpoint that must be passed before a SOC function moves from provider to institution.
- Joint Shift
- A monitoring shift staffed by provider and institution analysts working the same queue.
- Detection‑As‑Code
- Managing detection rules as versioned, tested, peer-reviewed files so they can be transferred and audited.
- Sovereign SOC
- A security operations capability owned, staffed, and governed by the institution it protects.
Related
Explore Connected Capabilities
Related services
Proof Points
What We Can Stand Behind
- National SOC and digital forensics design, financial-sector CERT advisory and sector SOC engagements in West and Southern Africa.
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Security Operations Build–Operate–Transfer
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Security Operations Build–Operate–Transfer with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Security Operations Build–Operate–Transfer will respond.
Government and strategic projects inquiry