Security Operations (OPS)

Security Operations governs the day-to-day delivery of security, compliance and resilience through defined processes, skilled personnel, monitoring, escalation procedures and continuous improvement. The OPS domain is where strategy becomes practice. Without operational discipline, the best-designed control architecture produces inconsistent results because implementation depends on individual skill and judgment rather than repeatable process.

The SCF's intent for OPS covers resources, procedures, runbooks and management structures aligned with organizational risk, service and resilience needs. Runbooks matter because incident scenarios that are only handled from memory introduce variation and delay. Escalation paths matter because security events that don't reach the right decision-makers in time produce worse outcomes regardless of how good the technical response is.

OPS is not the same as Security Operations Center (SOC) operations, though the SOC function falls within it. OPS encompasses physical security operations, data privacy operations and the management structures that ensure security functions are resourced, staffed and improving over time. The domain's explicit focus on continuous improvement distinguishes it from domains that establish baseline capabilities; OPS requires that baseline to get better.