Organisational policy that defines the requirements for the configuration, classification, response SLAs, escalation, runbooks and calibration of security and operational alerts, including the prevention of alert fatigue and quality metrics, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the requirements for integration between security monitoring and the incident response process (IRP), including activation criteria, mandatory playbooks, response phases, regulatory notification, post-mortem and periodic testing, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the requirements for security monitoring in production, including the definition of critical events, SIEM integration, behavioural correlation, coverage of monitoring domains and periodic review of detection rules, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the requirements for the production, formatting, centralisation, retention and protection of application and security logs, including a minimum event schema, mandatory events, masking of sensitive data, immutability and SIEM integration, proportional to the criticality level (L1, L2, L3).
Cross-cutting organisational policy that defines the traceability requirements between requirements, controls, validation evidence, build artefacts and operational events, ensuring that the security posture is auditable continuously and in proportion to the application's risk level.