Standard operating procedure · IT7C · Information Technology

Major Incident

Transactional procedure owned by Cybersecurity Operations in Information Technology. 8 numbered steps, 4 of them a person deciding and 4 of them agent work … more

Information Technology manual Service view

Procedure code

IT7C

Transactional

Rule versions in force

v4.6 · v3.7

2 governing rules stacked over it

In force since

2024-11-10

Earliest effective date across those rules

Last reviewed

2026-05-19

Latest review date across those rules

Rules approved by

Director, Security Operations

Rule health

2/2

0 under review · 0 superseded

There is no document register behind this header. The version, the dates and the approver names are read off the governing rules this procedure runs inside, which is the closest thing the estate holds to a document control record. Nobody wrote these procedures. There is no document library behind this page and no Word file anywhere in the estate. Every procedure below is generated from rows this platform already holds: the line and its ordered stations, the owning team and the person accountable for it, the policy items bound to that team, and the governance gates seeded against the function. The steps, the owners, the gates, the approvers, the dwell times and the volumes are read straight off those rows. The sentences that join them together are generated. Read a procedure as the estate describing itself, not as a document somebody signed.

Purpose and scope

What this procedure is for and where it stops

To run major incident to one repeatable standard inside Cybersecurity Operations, part of Information Technology. more

Entry condition

Runs transactional. Starts when an upstream system posts an event.

Exit condition

The unit clears board report, released by Director, Security Operations. more

In scope

Every unit of major incident raised inside Cybersecurity Operations, from the trigger below through to the final step.
4 of the 8 steps, which run without a person present.
4 decisions that stop the line until a named person releases it.

Out of scope

Anything outside the envelope set by the owning team. It leaves the line at a gate and becomes the named approver's decision.
Work that belongs to another function. This line hands off to legal and does not follow the unit there.
Shared-spine work. This line has none; every step is done inside the function.

Who owns it

Runs the line

Security Operations Orchestrator

Accountable person

Director, Security Operations

The end of the escalation path. Above them sits IT Chief of Staff for the function.

That team’s remit

Owns alert work end to end inside Information Technology. more

That remit describes the whole team, not this one procedure, so its counts are larger than the ones on this page.

Autonomy

80% now · ceiling 85%

Triage, enrichment and in-policy containment run in seconds because speed is the control. more

The procedure, step by step

8 numbered steps · 4 of them stop for a person

A step is one station on the line. more

No.	Step	Who does it	What happens	System of record	Time on the step	In flight
01	Declare HumanpolicyDecision	Director, Security Operations Releases: Director, Security Operations	Work stops. Director, Security Operations reviews what the line has produced and either releases the unit or sends it back. Nothing downstream of this step runs until that decision is made.Holds until: Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.	IT Service Management	1.2 hrsstandard 1.6 hrs	7
02	Contain Agentworkflow	Threat Intelligence Agent	Threat Intelligence Agent performs this step unattended at the workflow layer, inside the envelope its owning team has set, and writes an evidence record naming the actor, the authority it acted under and the digests of what it read and wrote.	Configuration Management Database	1.6 hrsstandard 2.1 hrs	46
03	Human commander HumanpolicyDecision	Director, Security Operations Releases: Director, Security Operations	Work stops. Director, Security Operations reviews what the line has produced and either releases the unit or sends it back. Nothing downstream of this step runs until that decision is made.Holds until: Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.	IT Service Management	2.5 hrsstandard 5.4 hrs	4
04	Assess exposure Agentworkflow	Forensics Support Agent	Forensics Support Agent performs this step unattended at the workflow layer, inside the envelope its owning team has set, and writes an evidence record naming the actor, the authority it acted under and the digests of what it read and wrote.	IT Service Management	2.5 hrsstandard 3.4 hrs	39
05	Legal notify HumanpolicyDecision	Director, Security Operations Releases: Director, Security Operations	Work stops. Director, Security Operations reviews what the line has produced and either releases the unit or sends it back. Nothing downstream of this step runs until that decision is made.Holds until: Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.Hands off to legal	IT Service Management	4.0 hrsstandard 7.9 hrs	8
06	Restore Agentworkflow	Vulnerability Agent	Vulnerability Agent performs this step unattended at the workflow layer, inside the envelope its owning team has set, and writes an evidence record naming the actor, the authority it acted under and the digests of what it read and wrote.	Configuration Management Database	3.0 hrsstandard 4.2 hrs	14
07	Post-mortem Agentworkflow	Security Policy Agent	Security Policy Agent performs this step unattended at the workflow layer, inside the envelope its owning team has set, and writes an evidence record naming the actor, the authority it acted under and the digests of what it read and wrote.	IT Service Management	54 minstandard 2.1 hrs	22
08	Board report HumanpolicyDecision	Director, Security Operations Releases: Director, Security Operations	Work stops. Director, Security Operations reviews what the line has produced and either releases the unit or sends it back. Nothing downstream of this step runs until that decision is made.Holds until: Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.	IT Service Management	4.0 hrsstandard 7.0 hrs	0

The swimlane

The same steps, laid out by who is holding the work

Three lanes: a person deciding, an agent working, and the shared services spine. more

Person4 stations and 59% of the dwellAgent4 stations and 41% of the dwellShared spine0 stations and 0% of the dwell6 crossings between lanes

Human

decides

Agent

does the work

GBS

shared spine

System

attributed by rule

IT Service Management

Configuration Management Database

IT Service Management

Configuration Management Database

IT Service Management

Click any station to see who does it, what it costs in time, the rule that gates it and the system attributed to it.

Run the procedure

One unit walked along that swimlane on the happy viable agentified path

Press run and a single unit enters at station 01. Each station takes exactly the dwell this platform records for it and is held by whoever the estate says holds it. more

speed

worked clock

00:00

allowance clock

00:00

stations cleared

0/8

the happy path, worked time0 min of 20 hrs

the same run against its allowance0 min of 34 hrs

Human

decides · 4

Agent

does the work · 4

GBS

shared spine · 0

run log

Nothing has happened yet. more

where the worked time goes20 hrs a unit

Person12 hrs · 59%Agent8.0 hrs · 41%6 crossings between lanes

what makes this path viable

The lanes are the recorded lanes. 4 of the 8 stations stop for a person and every one of them still does on this run.
Every one of the 4 decisions is still taken by the people who hold them. The happy path is that each one is released first time, not that it is skipped.
The owning team is held to a 85% autonomy ceiling and this run sits at 41% unattended, inside it.
2 systems are attributed across the stations, and 0 of them are connected. Nothing in this run has been watched executing against a real system of record.

what would have to change

3 of the 4 decisions can be handed over inside the 85% ceiling. more

could move to the agent lane

01 Declare — held by Director, Security Operations, 1.2 hrs a unit
03 Human commander — held by Director, Security Operations, 2.5 hrs a unit
05 Legal notify — held by Director, Security Operations, 4.0 hrs a unit

stays with a person

08 Board report — The last decision on the line. Something on every procedure ends with a person, so this one is never offered.

what this run is, and what it is not

This is a run, not a forecast. more

Happy means nothing goes wrong: no station raises an exception, no gate sends the unit back, no rework loop fires and nothing sits in a queue between stations. more

The second clock is the allowance. more

A decision may be handed to the agent lane only if two things hold … more

The run reads the station rows only. more

What this run does not model: arrival patterns, contention between procedures for the same person, shift patterns, weekends, learning curves, and the cost of anything. more

Run it again, going wrong

The same unit, the same stations, broken the way the estate already records breaking

This is the same unit on the same stations, breaking. more

No break below was chosen. more

One play head, two tracks, the same scale. The clean run stops when it runs out of stations; the other one keeps going.

As written

8 stations, nothing waiting, nothing sent back

0 min of 20 hrs

now Declare · Director, Security Operations · 1.2 hrs

As the ledger has it

the same stations, plus 5 categories the estate already counts

0 min of 40 hrs

now Declare · Director, Security Operations · 1.2 hrs

personagentshared spinework the break addsnobody working it

What breaks, and where it is counted

No break below was chosen. more

What the two runs say together

5 counted categories land on this procedure. more

What this run cannot claim

These breaks are shown together on one unit so the shape of a bad day fits on one screen. more

Attestations on this estate are written against intake items, not against procedures, so a step done off the platform cannot be matched to the attestation that covers it. more

Two clocks run. Worked time is the sum of the time the work is actually being done … more

Roles and responsibilities

6 named parties

The responsibility grid is assigned by a rule, not lifted from a chart. more

Party	RACI	Steps	Duty	Escalates to
Security Operations Orchestrator orchestrator	Runs the line	0	Sequences this line, holds its timetable and decides what has to surface to a person. more	Raises to Director, Security Operations when a unit falls outside the envelope or confidence drops below the floor.
Director, Security Operations person	Accountable and responsible	4	Holds 4 decisions on this line. more	Accountable to Director, Security Operations for the decisions held here.
Threat Intelligence Agent agent A3% autonomy · ceiling A3% 90% clean · 6% overridden	Responsible	1	Executes the cybersecurity operations step it owns, posts its evidence, and hands the unit to the next stage.	Escalates to Director, Security Operations when the unit falls outside the decision envelope or confidence drops below the floor.
Forensics Support Agent agent A3% autonomy · ceiling A3% 89% clean · 7% overridden	Responsible	1	Runs the repeatable portion of cybersecurity operations inside the shared transaction spine at spine cost and spine controls.	Escalates to Director, Security Operations when the unit falls outside the decision envelope or confidence drops below the floor.
Vulnerability Agent agent A3% autonomy · ceiling A3% 88% clean · 7% overridden	Responsible	1	Executes the cybersecurity operations step it owns, posts its evidence, and hands the unit to the next stage.	Escalates to Director, Security Operations when the unit falls outside the decision envelope or confidence drops below the floor.
Security Policy Agent agent A2% autonomy · ceiling A3% 93% clean · 11% overridden	Responsible	1	Holds the rules that bind every other agent in cybersecurity operations. more	Escalates on any decision that would breach a live policy version, with the clause cited.

Decision points and escalation

4 places this procedure stops

01 · Declare

1.2 hrs

Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.

Director, Security Operations

03 · Human commander

2.5 hrs

Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.

Director, Security Operations

05 · Legal notify

4.0 hrs

Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.

Director, Security Operations

08 · Board report

4.0 hrs

Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.

Director, Security Operations

Handoffs out of this procedure

Step 05 Legal notify passes the work to legal.

The rules this procedure runs inside

2 governing rules

Cybersecurity Operations Decision Envelope

active

IT7-POL-200 · envelope · vv4.6

Agents in this lane may act without a human when the alert sits inside the stated value, risk and confidence envelope. more

Approved by Director, Security Operations · in force 2024-11-10 · reviewed 2026-05-14

Binds Alert Triage Agent, Threat Intelligence Agent, Containment Agent, Forensics Support Agent, Phishing Response Agent, Vulnerability Agent

LATAM · US

Cybersecurity Operations Evidence Standard

active

IT7-POL-201 · evidence · vv3.7

Every autonomous decision writes inputs, the rule version applied, the model and prompt version, the output and a reversal path. more

Approved by Director, Security Operations · in force 2025-08-21 · reviewed 2026-05-19

Binds Alert Triage Agent, Threat Intelligence Agent, Containment Agent, Forensics Support Agent, Phishing Response Agent, Vulnerability Agent

US · Canada

Systems this procedure touches

2 named · 0 connected

System attribution is a rule, not a reading. more

System	Vendor	Domain	Criticality	Steps	Connection
IT Service Management	ServiceNow ITSM	itsm	high	6	modeled
Configuration Management Database	ServiceNow CMDB	itsm	high	2	modeled

0 of the 2 systems on this procedure is connected to the platform, and none of the twenty-six in the estate register is. 1 of them are marked as taking a write back, which is a property of the system, not a live path from here.

How it performs

End to end

19.7 hrs

Summed from the time each step sits, standard 33.8 hrs — running at 58% of the standard.

Touchless

82%

Agent share

50%

A week

2,187

In flight

140

Effort a week

703 human minutes · 481 agent minutes

Volume multiplied by the time on each step. more

Assurance over this procedure

4 governance gates sit above it

The twenty-four controls and eighteen exception classes in this platform are held at estate level … more

Gate	What trips it	Who releases it	Clock	Waivable
Privileged access grant approval	Any administrative, root or elevated entitlement	Identity governance and system owner	4 business hours	No
Firewall or network boundary change approval	Any rule affecting segmentation, ingress or egress	Network security lead	1 business day	No
Production database or destructive action approval	Any data-affecting operation in production, including bulk deletion	Data owner and CIO delegate	1 business day	No
Major incident command escalation	Any severity-one incident or suspected compromise	Incident commander	15 minutes	No

Next to it on the same team

Cybersecurity Operations

Security Alert Triage

IT7A

Phishing Campaign Response

IT7B

All of Information Technology

What this document is and is not

These procedures describe the modeled estate. more

Actions

What is waiting on a person

What one procedure document gives you, and what to check before you treat it as the standard.

151

named approvers appear across the library

Every decision point on every procedure carries a job title, not a queue. more

143

steps in the library hand their unit to another function

A handoff is where a procedure stops being one team’s problem. more

controls exist in the estate, and they belong to no procedure in particular

Controls and exception classes are held estate-wide. more

Operations

What this desk is allowed to start

A surface that only reports is not operable. more

Trigger and bound

A procedure document prints purpose, scope, entry and exit, the numbered steps with the actor on each, the roles and their RACI position, the swimlane, the decision points and escalation, the handoffs, the governing rules with version and approver, the systems by rule and the timings. more

Live observability

What the record shows right now

The whole library, by lane, so a single document can be read against the estate it came from. more

Current distribution

2,748 steps

Agent, inside the function1,38951%

Agent, on the shared spine85131%

Person deciding at a gate50818%

Is policy and strategy coming to fruition

Whether the written intent is holding here

Half. The document is complete and every actor on it is measured more

Not holding on the record

A procedure here carries a version, an approver, an in-force date and a last-review date. more