Skip to main content

Organisational Policies - Monitoring and Operations

The effective adoption of Chapter 12 - Monitoring and Operations requires the existence of formal organisational policies that regulate and sustain detection, correlation and response to security events in real time.

📌 Fundamental note​

⚠️ The practices described in this chapter - structured logging, alert rules, event correlation, IRP integration, MTTD/MTTR measurement - must be underpinned by clear, auditable organisational policies applicable to all operational environments.

These policies:

  • Make the technical application of monitoring practices mandatory and measurable;
  • Establish responsibilities for triage, escalation and incident response;
  • Ensure that operational visibility is coherent and effective across all systems and pipelines;
  • Serve as a reference for audits, post-incident analyses and continuous improvement of operational maturity.

🧾 Recommended policies​

Policy NameMandatory?ApplicationSummary of required content
Monitoring and Logging Policy✅ YesAll services and applicationsDefinition of events, logging levels, structured formats, centralised destinations.
Alerting and Behaviour Detection Policy✅ YesCritical systems and production environmentsTypes of sensitive events, thresholds, false-positive tolerance, response.
Service Observability Policy⚠️ OptionalMicroservices and distributed architecturesMinimum metrics, mandatory dashboards, correlation with logs.
Log Retention and Access Policy✅ YesAll security and operations logsRetention per log type and level (Policy 29 §7), ACL, encryption, access logging.
Operational Incident Response Policy✅ YesAll domains with active detectionResponse channels, playbooks, reporting, domain owners.
Agent Coverage and Instrumentation Policy⚠️ OptionalInfrastructure, cloud, endpointsTypes of mandatory agents, minimum coverage, maintenance of visibility.

🧱 Expected structure of each policy​

Each organisational policy must contain:

  • Objective and scope (which systems or environments it covers);
  • Types of events or conditions monitored (e.g. failed login, privilege escalation);
  • Rules for triage, escalation and mitigation;
  • Minimum log retention and the corresponding format and security;
  • Coverage required from agents or technical sensors;
  • Integration with the development and response lifecycle;
  • Periodicity of policy review, testing and audit.

✅ Final recommendations​

  • Policies must be reviewed regularly based on the evolution of threats and of the architecture;
  • They must be accessible to and understood by all technical and operational teams;
  • They must be reflected in CI/CD practices, in production environments and in release requirements;
  • They must be validated by internal audits and supported by continuous evidence (dashboards, tested alerts, visible logs).

📌 Well-defined policies are the foundation for effective operational observability and reaction - without them, even the most instrumented systems remain vulnerable to silent failures.