# Security operation record

Author: Adrian Sutherland  
Edition: Version 1.0  
Prepared: September 2026  
Copyright: © 2005–2026 Adrian Sutherland

Fictional worked record; decisions are proposed and checks are unrun.

## Owner and trigger

SEC-O1: suspicious partner access requires an incident owner; the rota and
contacts remain open. The example begins with a process-only trial; the later
case service is unimplemented.

## Containment and continuity

Restrict affected access and preserve protected logs. Pause unsafe acceptance
and arrange authorised contact with affected learners.

## Recovery and acceptance

Check trusted configuration and credentials. If restored data predates
accepted work, reconcile case C42 and handover H7 before resuming. The service
owner decides whether the service is ready to resume.

## Learning and checks

Access and restoration exercises are planned and unrun. Use their findings to
review which information may be disclosed and which controls the supplier owns.