Program components, maturity models, SOC operations, vulnerability management, third-party risk, KPIs