The main consideration for building a security operations center (SOC), regardless of the model, is the scope and service catalog. The scope and service catalog define the objectives, functions, and deliverables of the SOC, such as monitoring, detection, analysis, response, and reporting of security incidents and events. The scope and service catalog also specify the roles and responsibilities, processes and procedures, standards and metrics, and tools and technologies that the SOC will use to perform its tasks. The scope and service catalog should align with the organization's security policies and strategies, and meet the expectations and requirements of the stakeholders and customers. The scope and service catalog should also be flexible and scalable, to adapt to the changing security landscape and threats. The other considerations, such as skill set and training, headcount and capacity, and tools and technologies, are important, but they depend on the scope and service catalog of the SOC12. References: CISSP CBK, Fifth Edition, Chapter 7, page 633; CISSP Practice Exam - FREE 20 Questions and Answers, Question 16.

Reasons why a user won't report an incident (page 882 of Shon Harris 5th edition)
-Afraid of being pulled into something
-afraid of being accused Logically, they may be unaware of the procedure No reason that reporting incidents to a centralized location would be a problem so that leaves that as the answer.