Skip to main content

Supporting Examples for the Playbooks

📚 File Structure​

This folder (exemplo-playbook) contains example files that show how to implement the principles that SbD-ToE prescribes.

Important:

  • These are examples, not prescriptions
  • Each organisation must adapt them to its own context
  • The examples are reusable across multiple regulations (DORA, NIS2, ISO 27001, etc.)

📖 Available Files​

1. README.md (This file)​

Overview, structure and instructions for use

2. Toolchain Options​

What it covers: Tools for implementing IaC principles, logs, SCA/SAST

Related to (SbD-ToE):

Deliberate abstention covered:

  • ❌ The manual does NOT prescribe "Use Terraform" or "Use Splunk"
  • ✓ Example: How to implement "IaC" with Terraform, CloudFormation or Helm
  • ✓ Example: How to centralise logs with ELK, Datadog or Azure Sentinel

When to use:

  • Assessing which technology stack to adopt
  • Comparing tool options
  • Validating that a choice implements SbD-ToE principles

Deliverables:

  • Comparison of 3 options per dimension (IaC, Logs, SCA, SAST, CI/CD)
  • Code examples
  • Audit trail for each option

3. KPIs and Targets​

What it covers: KPIs and targets for different organisational profiles

Related to (SbD-ToE):

Deliberate abstention covered:

  • ❌ The manual does NOT prescribe "Target: Zero critical vulns"
  • ✓ Example: Fintech (small) - aggressive targets, short timeline
  • ✓ Example: Bank (large) - conservative targets, long timeline
  • ✓ Example: SME (distributed) - pragmatic targets

When to use:

  • Setting targets for the organisation
  • Communicating with executives ("Why not 100%?")
  • Adjusting according to maturity

Deliverables:

  • Visual KPI dashboards (per scenario)
  • Target tables (per dimension)
  • Target-setting process

4. RACI and Governance​

What it covers: RACI and governance structure

Related to (SbD-ToE):

Deliberate abstention covered:

  • ❌ The manual does NOT prescribe "CISO reports to CTO" or "7 meetings/week"
  • ✓ Example: Fintech (small) - lean RACI, fortnightly meetings
  • ✓ Example: Bank (large) - structured RACI, multiple levels
  • ✓ Example: SME (distributed) - hybrid RACI, remote communication

When to use:

  • Designing the governance structure
  • Defining responsibilities
  • Structuring communication/meetings

Deliverables:

  • Organisation charts (per scenario)
  • RACI matrices (per activity)
  • Meeting calendars
  • Approval procedures

5. Incident Report​

What it covers: Incident reporting template

Related to (SbD-ToE):

Deliberate abstention covered:

  • ❌ The manual does NOT prescribe "Official DORA ITS template"
  • ✓ Example: How to structure a report (what, when, how, who, impact, action)
  • ✓ Example: Fields for traceability

When to use:

  • Configuring an incident tool (Jira, ServiceNow, etc.)
  • Aligning the team on the definition of an incident
  • Preparing for a DORA audit

6. 05-exemplo-rto-rpo.md (next to be created)​

What it covers: Definition of RTO/RPO per app

Related to (SbD-ToE):

Deliberate abstention covered:

  • ❌ The manual does NOT prescribe "RTO: <1h" or "RPO: <15min"
  • ✓ Example: How to define per L1/L2/L3 app
  • ✓ Example: How to implement (backups, replicas, failover)

When to use:

  • Designing the availability architecture
  • Communicating criticality internally

7. 06-exemplo-roadmap-adaptado.md (next to be created)​

What it covers: Roadmaps adapted to different scenarios

Related to (SbD-ToE):

Deliberate abstention covered:

  • ❌ The manual does NOT prescribe "Phase 0 always 2 months"
  • ✓ Example: Short timeline (Fintech: DORA urgency)
  • ✓ Example: Long timeline (Bank: complexity + governance)
  • ✓ Example: Pragmatic timeline (SME: resources)

When to use:

  • Planning the implementation
  • Communicating the executive timeline
  • Adapting to the real context

8. 07-exemplo-politica-seguranca.md (next to be created)​

What it covers: Security Policy template

Related to (SbD-ToE):

Deliberate abstention covered:

  • ❌ The manual does NOT prescribe a "Generic Security Policy"
  • ✓ Example: Structure, minimum content, signature
  • ✓ Example: Reference to SbD-ToE and DORA

When to use:

  • Drafting an internal policy
  • Validating essential content
  • Preparing for Board approval

9. 08-exemplo-contrato-fornecedor.md (next to be created)​

What it covers: Technical security clauses in contracts

Related to (SbD-ToE):

Deliberate abstention covered:

  • ❌ The manual does NOT prescribe "Specific legal clauses"
  • ✓ Example: Technical requirements (SbD compliance, training, etc.)
  • ✓ Example: Response SLAs (incidents, remediation, etc.)

When to use:

  • Negotiating with suppliers
  • Including security requirements
  • Aligning with DORA Art. 28–30

🔍 How to Find What Is Needed​

"I need to choose tools"​

→ Toolchain Options

"How do I set security targets?"​

→ KPIs and Targets

"How do I structure governance?"​

→ RACI and Governance

"How do I report incidents?"​

→ Incident Report

"How do I define RTO/RPO?"​

→ RTO/RPO Example (to be created)

"How do I plan the implementation?"​

→ Adapted Roadmap Example (to be created) + DORA Playbook

"How do I write the policy?"​

→ Security Policy Example (to be created)

"How do I close a secure contract?"​

→ Supplier Contract Example (to be created)

📋 Usage Checklist​

When using these examples:

  • Read the README - Understand the purpose
  • Select the relevant example - By context/abstention
  • Adapt to the context - Do not copy directly
  • Validate with stakeholders - GRC, Legal, Compliance
  • Test before implementing - Validate the audit trail
  • Document decisions - Why X was chosen over Y
  • Iterate - Adjust according to lessons learned

🔗 Relationship with the Manual's Chapters​

SbD-ToE Manual
├─ [Cap. 01](/sbd-toe/sbd-manual/classificacao-aplicacoes/intro) - Classificação de Aplicações
│  └─ Exemplo: 05-rto-rpo.md, 06-roadmap.md
├─ [Cap. 02](/sbd-toe/sbd-manual/requisitos-seguranca/intro) - Requisitos de Segurança
│  └─ Exemplo: 07-politica-seguranca.md
├─ [Cap. 05](/sbd-toe/sbd-manual/dependencias-sbom-sca/intro) - Dependências, SBOM e SCA
│  └─ Exemplo: 01-toolchain (SCA)
├─ [Cap. 08](/sbd-toe/sbd-manual/iac-infraestrutura/intro) - IaC e Infraestrutura
│  └─ Exemplo: 01-toolchain (IaC options)
├─ [Cap. 12](/sbd-toe/sbd-manual/monitorizacao-operacoes/intro) - Monitorização e Operações
│  └─ Exemplo: 01-toolchain (logs), 02-kpis, 04-incidentes
├─ [Cap. 14](/sbd-toe/sbd-manual/governanca-contratacao/intro) - Governança e Contratação
│  └─ Exemplo: 03-raci-governance.md, 07-politica.md, 08-contrato.md
└─ Playbook DORA
   └─ Exemplo: Todos (implementar princípios)

⚠️ Important Warnings​

  1. These examples are illustrative

    • Do not copy them directly
    • Adapt them to the legal, regulatory and operational context

  2. Consult specialists

    • GRC/Compliance for policies
    • Legal for contracts
    • Security for architecture

  3. Test before using in production

    • Validate the audit trail
    • Verify compliance with DORA
    • Confirm integration

  4. Update regularly

    • DORA evolves (RTS/ITS)
    • Tools evolve
    • Best practices evolve

🔄 Update Process​

These examples will be updated when:

  • DORA RTS/ITS change
  • New major version of SbD-ToE
  • Feedback from real implementations
  • Changes in best practices

Next review: when one of the conditions above occurs.

📞 Feedback​

If any of the following is found:

  • ❓ Ambiguity in the examples
  • 🐛 Technical error
  • ✨ Suggestion for improvement
  • 🔄 New example needed

Contact: [reserved for future releases]

Version: 1.0
Date: November 2025
Next update: with the next revision of the regulatory coverage matrix.