How to choose and work with an outsourced SOC