Overview
Procedures are the detailed, step-by-step instructions that tell people exactly how to carry out a task securely and consistently. They are the most operational layer of the policy hierarchy — where intent finally meets action.
Learning objectives
- Define a procedure and its role.
- Explain why documented procedures matter for security and reliability.
- Recognize good procedure characteristics.
Core concept
A procedure is a precise sequence of steps to accomplish a specific task in support of a policy and its standards. Where a standard says "laptops must be encrypted," the procedure says exactly how to encrypt one: the tool, the settings, the verification step, and who records the result. Procedures remove ambiguity so the task is done the same correct way every time, by anyone.
How it works
Documented procedures deliver repeatability and resilience. They let a task be performed correctly by someone who is not an expert, ensure nothing critical is skipped under pressure, and preserve knowledge when staff leave. In security operations, specialized procedures called runbooks or playbooks guide responders through incidents step by step, which is vital when people are stressed and time matters.
Practical example
A company's incident-response playbook for a suspected phishing compromise lists exact steps: reset the user's password, revoke active sessions, check mailbox rules for tampering, search for other recipients of the email, and document each action. During a real incident at 2 a.m., a junior analyst follows the playbook and handles it correctly — because the procedure captured the expert knowledge in advance.
Cybersecurity relevance
Procedures and runbooks are central to the SOC & Blue Team path and to incident response. Well-written procedures are what make security operational rather than heroic — reliable outcomes that do not depend on a single expert being awake.
Common mistakes
- No written procedures, so outcomes depend on individual memory and expertise.
- Outdated procedures that no longer match the systems, causing errors.
- Procedures too vague to follow or too rigid to fit real situations.
Key takeaways
- Procedures are step-by-step instructions for performing a task securely and consistently.
- They provide repeatability, preserve knowledge, and reduce mistakes under pressure.
- Incident-response runbooks/playbooks are critical procedures for security operations.
Check your understanding
- How does a procedure differ from the standard it supports?
- Why are incident-response playbooks especially valuable during a live incident?