Procedures

• Procedures are an adjunct to policies, they are step-by-step instructions for carrying out operational tasks. 

• A procedure will often be the instrument by which a policy is converted into action. 

• Important procedures should consider

• Procedures for handling, and if necessary escalating, security incidents

• Procedures for scanning networked IT systems for known vulnerabilities, and where justified for penetration testing