5.1c security procedures

Change management process steps

Determine scope, assess risk, create formal plan, get end-user approval, execute, document.

Change control board

Group responsible for analyzing, approving, and scheduling proposed changes; also verifies a backup/rollback plan exists.

Onboarding procedure

Bringing a new hire or transfer into the organization: AUP sign-off, account creation, correct rights/permissions, equipment provisioning.

Offboarding procedure

Formal process for departure: handling assigned hardware and data, disabling (not deleting) the account.

Disable vs delete on offboarding

Accounts should be disabled, not deleted, in case encrypted files or important data tied to that account need to be retrieved later.

Playbook

A documented, step-by-step sequence of actions for handling a specific type of event, such as data breach investigation or ransomware recovery; one playbook per scenario type.

SOAR (Security, Orchestration, Automation, and Response)

Platform integrating multiple third-party security products into one system, automating connections and mundane tasks so security teams can focus on higher-value work.

Playbooks vs SOAR

Playbooks are the documented content, the steps a human or system follows. SOAR is the platform that can execute those steps automatically.

Continuous procedure revision

Processes and playbooks must be regularly updated to reflect new technologies, tightened security postures, and emerging threats.

Governance board

Sets broad objectives and requirements, typically a board of directors or similar panel of specialists.

Governance committee

Subject matter experts who take direction from the board and determine implementation details, then report back for approval.

Public sector governance considerations

Government organizations face additional legal, administrative, and political concerns; meetings are typically open to the public.

Centralized vs decentralized governance

Centralized: one central group makes decisions for the entire organization. Decentralized: decisions are made by others closer to the work.