A Data-Center Protection System Based on a Security Operations Center (SOC): A Comparative Architectural Framework and Performance-Indicator Analysis

Data centers have become a critical node of the digital economy, hosting identity systems, cloud services, business applications, and facility-operation technologies. As the attack surface expands and workloads migrate to hybrid and multi-cloud environments, perimeter-only controls are no longer sufficient. This study examines the Security Operations Center (SOC) as an operational protection system for data centers rather than a mere collection of monitoring tools. The research follows a comparative analytical method that synthesizes peer-reviewed literature published from 2020 onward, official industry and agency reports (IBM, Verizon, ENISA, and Uptime Institute), and authoritative frameworks (NIST CSF 2.0, NIST SP 800-61r3, ISO/IEC 27001:2022, ISO/IEC 27035:2023, and the NIS 2 Directive). The evidence shows that the global average cost of a data breach was USD 4.44 million in IBM’s 2025 report and rose to USD 4.99 million in the 2026 report, while mean time to identify and contain fell to 241 days; ransomware appeared in 44% of breaches analyzed by Verizon in 2025; and distributed denial-of-service remains the most frequently observed threat in the European landscape. The paper proposes a six-layer DC-SOC model that integrates cyber telemetry with cyber-physical facility signals (BMS/OT) and risk-based governance. Effectiveness, the study concludes, is not achieved by procuring a single platform, but by balancing people, process, and technology and by measuring maturity through MTTD, MTTR, and analysis quality rather than raw alert volume.