Security: SOPs
Six procedures covering triage, the approval gate, containment, vulnerability handling, access review and the exception register.
Markdown. No sign-up, no email.
SOP 1: Triage#
Run: continuously, worked in score order.
- The analysis agent correlates raw signals into events. Analysts read events, never raw alerts.
- Every event carries its evidence and its baseline departure.
- Nothing is closed without a recorded reason. "Closed, no action" is a legitimate outcome and an illegitimate blank.
- Anything closed as a false positive feeds tuning within the week.
Closing without investigation is the metric that precedes every missed intrusion, which is why it is counted rather than discouraged.
SOP 2: The approval gate#
Run: on any response action.
| Step | Rule |
|---|---|
| Score | Automated. Orders the queue, decides nothing |
| Present | Event, evidence, proposed response, and the blast radius of that response |
| Approve | A named human. Under 15 minutes for high-risk, at any hour |
| Execute | Only pre-approved action types, only after approval |
| Verify | Confirm it took effect. An unverified response is an assumption |
| Log | Who approved, what ran, what changed |
The blast radius line is not optional. Disabling a service account stops an attacker and may also stop payroll. The approver must see both halves before deciding.
SOP 3: Containment#
Run: on confirmed compromise.
- Preserve evidence before changing anything. Snapshot, capture memory if feasible, export logs. Containment destroys the evidence needed to understand scope.
- Contain, then eradicate, then recover. In that order.
- Rotate credentials after the access path is closed. Rotating first tells the attacker they are seen while they still have a way back in.
- Assume lateral movement until disproven. The first host found is rarely the first host used.
- Freeze automated remediation on affected systems for the duration.
SOP 4: Vulnerability handling#
Run: continuously, reviewed weekly.
Prioritise by exploitability and exposure, not by CVSS alone. A critical on an internal system nobody can reach matters less than a medium on the login page, and a scanner cannot tell you that.
| Severity, adjusted for exposure | Fix within |
|---|---|
| Critical, internet-facing | 48 hours |
| Critical, internal | 7 days |
| High | 30 days |
| Medium | 90 days, or accept with a dated exception |
SOP 5: Access review#
Run: quarterly, with Data and Analytics.
- Every account, every privilege, every service credential.
- Anything unused for 90 days is removed, not queried. Restoring access takes minutes; standing unused privilege is permanent attack surface.
- Every service account has a named human owner. An unowned service account is the one nobody notices being used.
- Credentials older than 180 days are rotated on a schedule rather than after an incident.
SOP 6: Exception register#
Run: monthly.
Every accepted risk gets a row: what, why, who accepted it, and when it expires.
An exception without an expiry is not an exception, it is a decision nobody admitted making. The monthly review exists to find the ones whose date passed, and there are always some.
Escalation#
| Situation | Goes to |
|---|---|
| Confirmed compromise | Incident lead and CEO immediately. Legal within the hour if data is involved |
| Customer data possibly exposed | Legal, for the notification clock. It starts before you are certain |
| Approval unreachable for a high-risk event | Deputy. If also unreachable, escalate rather than auto-approve |
| An agent proposing a response outside the allowlist | Refuse, investigate why it was proposed |
| Coverage below 95% | CTO. Unmonitored assets are the ones that get used |