Security Procedures and Playbooks

To recap: our policy defines our security principles, and our standards define the requirements we need to align with those principles.

That brings us to procedures and playbooks, which turn the standards into action. They give our team the tools and instructions they need to meet the security expectations placed on them through our policy suite in a way that can be measured, repeated, and iterated on as our business evolves.

​important​ Procedures and playbooks are living and evolving operational documents that should be collaborated on across your team. They exist to teach teams how to carry out their responsibilities, to reduce the chance of key person risk, and to ensure that whenever these important tasks are carried out, that they are done consistently.

What’s the difference between a procedure and a playbook?

​Definition​ A procedure is a singular action or set of steps that define how you consistently complete a task. For example, you may have a procedure for how to refill the coffee machine in your office.

​Definition​ A playbook is a set of actions or steps you would follow to navigate a more complex scenario. They will often include multiple decision points and paths that are based on the context.

Do You Need a Procedure or a Playbook?

When deciding whether you can define a simple procedure or need a more comprehensive playbook, start with the following three questions:

1. Is the action we need to take singular or simple to define?

   • If yes, then it’s probably a procedure you need to develop.

2. Does it have different pathways or variations depending on some form of context?

   • If yes, then you probably need a playbook that can advise the person or team taking action what to do in a variety of situations.

3. Does this action fit in with other, non security actions or processes?

   • If yes, then it’s probably an existing procedure you need to adapt or add to (while respecting the original purpose).

Once you decide what you need, take a set of requirements defined by a standard, and turn them into easy-to-understand, repeatable steps that can be completed by someone on your team.

Example Procedures and Playbooks

Let’s go back to our example standard and pick out one of the actions that we created to support our policy.

Using our guide above, we should be able to determine that it’s a procedure we need to develop rather than a playbook, since:

• Our requirement here is short and concise.

• There are very few variations on how it will happen or how it applies to different situations.

In this case, our procedure is to ensure that all new hires read and accept the “Acceptable Use” guidelines we have developed.

The easiest way to implement this is to add this to our “New Hire Onboarding Checklist” as per the example below. As there are many different things a new employee is expected to do in their first few days, this will fit with the existing processes without causing disruption or breaking the cultural flow of the new team member’s first week.

Now let’s take a look at a potential playbook scenario from the same security standard:

This time the requirement is more complicated and includes a number of different configurations or pathways depending on the role and location of the new employee.

• Employees working remotely or in subsidiaries may require different background checks.

• Roles handling sensitive information or financial transactions may require credit checks or additional character references.

• Temporary employees may need a cut down set of checks proportional to their intended period of employment.

In this case, a playbook is needed. This playbook will walk through step-by-step instructions for each of these scenarios and make it easy for the hiring manager to decide which checks are needed and action them.

As you can see, whether it’s as a procedure or a playbook, our policy principles are defined in our standards and implemented in our procedures and playbooks. They are a linked hierarchy of documents that outline our security expectations as a company and give our team the tools and instructions they need to meet them (and if you do it well, there isn’t a bit of legalese in sight).