Organisational policy that defines the requirements for the configuration, classification, response SLAs, escalation, runbooks and calibration of security and operational alerts, including the prevention of alert fatigue and quality metrics, proportional to the criticality level (L1, L2, L3).
Specifics of exception management in the context of monitoring and operations - alert silencing, log retention and regulatory implications
Rules, thresholds and best practices for effective alerts based on sensitive events.
Technical and operational indicators for the assessment of the effectiveness of the security monitoring programme, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.
Canonical catalogue of requirements for the security monitoring and operations programme (OPS-001 to OPS-017), with applicability by risk level and acceptance criteria for centralised logging, critical events, retention, SIEM, alerts, response SLA, correlation, integration with the IRP, behavioural detection, effectiveness metrics and continuous operational health signals, backups with tested restore and recovery of the application.
Organisational policy that defines the requirements for active monitoring after each deploy to production, including a mandatory observation window, minimum health metrics, alert thresholds, human validation and rollback activation criteria, proportional to the criticality level (L1, L2, L3).
Applied examples of logging, alerts and correlation in real contexts