حوكمة ومخاطر وامتثال الأمن السيبراني (GRC) 14 بند
Security Operations Center (SOC) Operations Runbook Audit
قائمة التحقق هذه باللغة الإنجليزية.
Audits the operational runbooks and processes of a security operations center, including alert triage, escalation, shift management, and continuous improvement.
NIST 800-61NIST 800-53ISO 27001
PDF أو Word مجانًا · أدخل بريدك الإلكتروني للتنزيل.
Coverage & Staffing
- Is SOC monitoring coverage defined (24x7, follow-the-sun, or business-hours)? *
- Are analyst roles and tiers (T1/T2/T3) documented with responsibilities? *
- Is there a defined escalation path to incident response and management? *
- Are on-call rotations and contact trees maintained and current? *
Triage & Runbooks
- Do documented runbooks exist for the most common alert types? *
- Do runbooks define triage steps, enrichment sources, and decision criteria? *
- Are alert severity and priority definitions standardized? *
- Are runbooks reviewed and updated after significant incidents or changes?
Shift Management
- Is a structured shift handover process used to transfer open items? *
- Are open and in-progress cases tracked in a case management system? *
- Is an operational log of shift activity maintained?
Metrics & Improvement
- Are SOC performance metrics (MTTD, MTTR, alert volume) tracked? *
- Are recurring false positives fed back to detection engineering for tuning? *
- Is analyst burnout and alert fatigue monitored and managed?
نزّل قائمة تحقق Security Operations Center (SOC) Operations Runbook Audit كاملة
احصل عليها مجانًا بصيغة PDF أنيقة قابلة للطباعة أو مستند Word قابل للتعديل.