Technical and operational indicators for the assessment of the effectiveness of the security monitoring programme, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.
Definition and calculation of indicators such as MTTD and MTTR, and their application in operational dashboards.
Canonical catalogue of requirements for the security monitoring and operations programme (OPS-001 to OPS-017), with applicability by risk level and acceptance criteria for centralised logging, critical events, retention, SIEM, alerts, response SLA, correlation, integration with the IRP, behavioural detection, effectiveness metrics and continuous operational health signals, backups with tested restore and recovery of the application.