# Security operation record

Author: Adrian Sutherland  
Edition: Version 1.0  
Prepared: September 2026  
Copyright: © 2005–2026 Adrian Sutherland

Replace prompts with your own decisions, sources and results. Link existing records where useful.

## Owner and trigger

Name incident, service and supplier roles and contact arrangements.

## Containment and continuity

Define permitted containment actions and continuing business work.

## Recovery and acceptance

Describe how to restore the service, reconcile its records and decide who may authorise work to resume.

## Learning and checks

Record findings from incidents and exercises, and which decisions need review.