Secure operation and maintenance procedure

Secure operation and maintenance procedure

OP-01 — Operational ownership

The operations owner maintains the service description, current configuration, support arrangements and operating responsibilities for [system]. The record identifies users, essential functions, information processed, dependencies and relevant risk decisions. Ownership continues through maintenance and retirement, including periods when no active development project exists.

The owner accepts the release handover and confirms access to the instructions, evidence and contacts needed to operate the system. Open defects, vulnerabilities, exceptions and conditions are assigned to named people. The operating record identifies service hours, response arrangements and any limitations in coverage. Coverage outside those arrangements is not implied by the existence of a monitoring tool.

OP-02 — Routine operation

Operators use the approved instructions and configuration for routine activities. Instructions identify the action, prerequisites, authority, expected result and evidence where required. Operational work includes access administration, scheduled processing, backup, data transfer, service checks and support requests. Actions affecting system state or information are recorded according to their significance and the adopted controls.

Operators report unexpected behaviour, unclear instructions and unmet service conditions through the issue or incident route. Where an instruction cannot be followed, the record states what prevented it and the decision made. Repeated manual corrections or informal workarounds are reviewed for a need to change the system or its operating procedure.

OP-03 — Monitoring and event handling

The owner maintains a monitoring plan identifying relevant service, security and privacy conditions, the source of observations, thresholds or decision criteria, recipient and response. Monitoring covers essential functions and material dependencies, including supplier status where relied upon. The plan records expected coverage and known blind spots.

Events are assessed in context and routed to operational work, vulnerability handling, incident response or risk review. Alert records identify the observation, time, affected scope, analysis and disposition. Where no action is required, the reason is recorded at the level appropriate to the event. Alert volume is reviewed for missed signals and unworkable workloads; the absence of handled alerts is not automatically interpreted as absence of adverse activity.

OP-04 — Access and configuration maintenance

The owner reviews operational identities, privileges and service connections at [schedule] and when responsibilities change. Access changes follow the recorded authority and retain the relevant evidence. Administrative, supplier and emergency access are included. The review identifies permissions that no longer match the assigned purpose and arranges correction or an explicit decision.

Configuration is compared with the approved baseline according to the schedule and after relevant events. Changes follow the change procedure, including settings altered through provider consoles or automated services. The owner maintains current dependency and software inventories so that new vulnerability information can be connected to actual deployed systems.

OP-05 — Maintenance

The maintenance owner identifies preventive and corrective work required to sustain the service, including supported versions, updates, capacity, certificate and credential lifecycle, equipment and supplier changes. Work is planned around service needs and authorised through the applicable change arrangement. The plan identifies affected functions, verification, communication and recovery.

Maintenance performed remotely or by a supplier has a recorded purpose, access scope, responsible contact and completion evidence. Temporary access is closed or reviewed according to its authorisation. After maintenance, the owner verifies the resulting configuration and relevant system functions. Deferred maintenance is recorded with its risk, owner and review event rather than disappearing into an unprioritised task list.

OP-06 — Information and service requests

Requests from users and affected people are routed to the owner able to resolve them. The record identifies the request, relevant service or processing activity, verification of the requester where needed, action and response. Privacy-related requests use the privacy procedure and applicable obligation record. Support records avoid collecting more sensitive information than needed for the support purpose.

Operational data quality issues are assessed for their effect on decisions, users and dependent services. Correction records identify the affected data and downstream consequences. Where incorrect outputs have already been used, the owner considers notification and remediation with affected stakeholders. A corrected database value alone may not resolve the consequences of earlier use.

OP-07 — Review the operating basis

At [schedule], the owner reviews whether the system remains fit for intended use and whether the assumptions supporting its authorisation remain valid. The review considers incidents, vulnerabilities, performance, supplier changes, stakeholder feedback, new processing purposes and assurance findings. Material changes enter requirements and risk assessment before the existing decision is relied upon for the changed scope.

The owner reports unmet promises, unresolved risks and support limitations to the designated authority. Improvement actions have owners, dates and verification. End-of-support or loss of a critical dependency triggers a decision on continued operation, replacement or retirement. The operating responsibility remains assigned while that decision is pending.

Operating record: [OP ID; service; system baseline; owner]
Purpose and users: [Functions; stakeholders; permitted operating scope]
Support and contacts: [Hours; routes; deputies; supplier contacts]
Operational criteria: [Service targets; essential functions; limits]
Routine work: [Instructions; responsibilities; schedules; evidence]
Monitoring: [Signals; sources; thresholds; recipients; response]
Maintenance and access: [Plans; authorisation; review; open deviations]
Current risk and assurance: [Decisions; findings; conditions; next review]