Skip to content

Runbook

What is Runbook?

A documented set of standardized procedures and actions that guide operators in performing routine operations and responding to specific scenarios.

Information Security

Frameworks that govern runbook

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on runbook

Requirements naming runbook across 6 standards, quoted from the control text.

NIST SP 800-922 controls

Establish a log management programme per NIST SP 800-92 Chapter 2 (Introduction to Computer Security Log Management) + Chapter 4 (Log Management Planning).

NISTSP92-1 · Log Management Programme, Policy, Roles, and Operational Runbooks →
HKMA TM-G-12 controls

HKMA TM-G-1 IT Operations. (1) IT OPERATIONS MANAGEMENT (TM-G-1.5.1) - 24x7 operations + monitoring + service delivery + ITIL + ITSM + operations runbooks + procedures + sound operational practices + automation + DevOps + SRE + IT service management metrics +...

HKMA-TMG1-Operations-Capacity-Problem-Incident · TM-G-1 IT Operations + Capacity + Performance + Problem + Incident Management →
AWS Well-Architected Security Pillar1 control

Run blameless post-incident reviews, capture root causes and contributing factors, and feed improvements back into controls, runbooks and training.

SEC10-BP08 · Establish a framework for learning from incidents →
Kuwait National Cybersecurity Framework1 control

Kuwait NCF Detect function. Security Monitoring and Logging: comprehensive logging (Identity + Network + Endpoint + Cloud + Application + Database + Privileged Access + Network Devices + Cloud Trail + Container + IoT/OT) + centralised log management + Security...

KNCF-Detect-Monitoring-SIEM-SOC-Threat-Intel-CTI-MITRE-ATT-CK-EDR-XDR-MDR-24-7-Continuous · Kuwait NCF Detect + Monitoring + SIEM + SOC + Threat Intel + EDR + XDR + 24/7 →
NIST SP 800-1461 control

Apply NIST SP 800-146 Section 9.4 (Security Recommendations) and Section 9.5 (Privacy Recommendations) across the cloud portfolio. Security recommendations must address (a) shared responsibility model documented per service-model, (b) identity and access manag...

NISTSP146-6 · Cloud Security and Privacy Recommendations →
NIST SP 800-1871 control

Establish continuous monitoring of LTE specific risk indicators including authentication failure rates, integrity check failures, Diameter and SS7 anomalies, and unexpected algorithm downgrades.

SP800-187-3.17 · Monitoring and Incident Response for LTE →

Questions people ask about runbook

What is Runbook?
A documented set of standardized procedures and actions that guide operators in performing routine operations and responding to specific scenarios.
Why is Runbook important for compliance?
Runbook is a key concept in Information Security. Understanding runbook helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,027 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Runbook?
Runbook appears in the requirement text of NIST SP 800-92, HKMA TM-G-1, AWS Well-Architected Security Pillar, Kuwait National Cybersecurity Framework, NIST SP 800-146. Across these standards we have identified 8 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Runbook?
Explore our compliance framework pages to see how runbook applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,027 frameworks.

See how Runbook applies across compliance frameworks

Our platform maps 1,027 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.