Domain
Operations
This directory contains production and infrastructure security standards, procedures, and operational governance artefacts. It covers the security and integrity of IT infrastructure, cloud environments, operational technology, monitoring operations, and change management.
Note
Its original content is released under CC BY-SA 4.0; a quotation that NOTICE.md (opens in a new tab) allows or keeps under its transition clause keeps its source licence and is not relicensed under CC BY-SA 4.0.
Framework, 1
Frameworks
Standard, 11
Standards
- Capacity and Performance Management Standardv1.0.6
- Certificate Authority Management Standardv1.3.12
- Cloud Security Configuration Baselinev1.4.23
- IT Financial Management Standardv1.0.8
- Network Security and Segmentation Standardv1.4.21
- Observability and Telemetry Standardv0.0.8
- OT/ICS Security Standardv1.0.10
- Physical Security of IT Infrastructure Standardv1.3.10
- Production Security Requirementsv1.1.32
- Service Level Management Standardv1.0.7
- Site Reliability Engineering Standardv1.0.6
Procedure, 9
Procedures
- Change Management and Configuration Control Procedurev1.3.16
- Endpoint Management and Device Compliance Procedurev1.7.1
- Media Handling and Transport Procedurev1.10.1
- OT Change Management Procedurev1.0.8
- OT Incident Response Procedurev1.3.4
- Patch Management Procedurev1.0.29
- Release Management Procedurev1.0.14
- Security Monitoring and Alert Management Procedurev1.4.2
- Threat Intelligence and SIEM Operations Procedurev1.3.18
Register, 4
Registers
Annex, 2
Annexes
Leadership, 10
Leadership pages for this area
Pages from the executive layer that tag this area. They explain and advise; the documents above govern.
- What the governing body should require before an AI system goes into productionexecutive brief
- What the governing body should require for IT operations governance oversightexecutive brief
- From AI idea to retirement: the governed life of an AI systemjourney
- What the governing body should ask about enterprise architecture and accumulated technology debtoversight question set
- What the governing body should ask about the organization's AI inventory, risks, incidents, suppliers, and changeoversight question set
- What the governing body should ask about the organization's change control, patch posture, estate inventory, monitoring, and service performanceoversight question set
- When a customer-data service must move after its legal operating boundary changesscenario
- When a release-signing key is compromised after software reaches productionscenario
- When an unauthorized production change takes a critical service downscenario
- When the enterprise identity provider can no longer be trustedscenario
Next on the tour
Open a domain: Resilience