사이버보안 GRC 14개 항목
Security Operations Center (SOC) Operations Runbook Audit
이 체크리스트는 영어로 제공됩니다.
Audits the operational runbooks and processes of a security operations center, including alert triage, escalation, shift management, and continuous improvement.
NIST 800-61NIST 800-53ISO 27001
무료 PDF 또는 Word · 이메일을 입력하면 다운로드할 수 있습니다.
Coverage & Staffing
- Is SOC monitoring coverage defined (24x7, follow-the-sun, or business-hours)? *
- Are analyst roles and tiers (T1/T2/T3) documented with responsibilities? *
- Is there a defined escalation path to incident response and management? *
- Are on-call rotations and contact trees maintained and current? *
Triage & Runbooks
- Do documented runbooks exist for the most common alert types? *
- Do runbooks define triage steps, enrichment sources, and decision criteria? *
- Are alert severity and priority definitions standardized? *
- Are runbooks reviewed and updated after significant incidents or changes?
Shift Management
- Is a structured shift handover process used to transfer open items? *
- Are open and in-progress cases tracked in a case management system? *
- Is an operational log of shift activity maintained?
Metrics & Improvement
- Are SOC performance metrics (MTTD, MTTR, alert volume) tracked? *
- Are recurring false positives fed back to detection engineering for tuning? *
- Is analyst burnout and alert fatigue monitored and managed?
Security Operations Center (SOC) Operations Runbook Audit 체크리스트 전체 다운로드
인쇄하기 좋은 PDF 또는 편집 가능한 Word 문서로 무료로 받으세요.