IT Runbook/Playbook

Detects IT runbooks and operational playbooks containing procedures, credentials, and escalation paths.

Type

regex

Confidence

medium

Confidence justification

Medium confidence: keyword-based detection requires corroborative evidence for accurate identification.

Jurisdictions

global

Regulations

SOCI Act 2018 (Cth), TIA Act 1979 (Cth)

Frameworks

CIS Controls, DISP, ISO 27001, NIST CSF, SOC 2

Data categories

technology, security

Scope

narrow

Risk rating

4

Should match

• Operational runbook — Low-tier probe - title without substantive procedure content
• Operational runbook: prerequisites, procedure steps, and verification steps. — Medium-tier probe - substantive procedure sections without an IT asset subject
• IT runbook: database service account prerequisites, procedure steps, and rollback procedure. — High-tier probe - procedure sections plus infrastructure and privileged-access context

Should not match

• Sports playbook strategy — Sports-domain sibling
• Run the book club meeting — Lexical near-match without a runbook title
• The public catalogue lists an operational runbook available for download. — Public listing contains only a title and must remain discovery-only
• Template example: IT runbook for a database service account with prerequisites, procedure steps, and rollback procedure. — Template contains otherwise high-tier evidence

Known false positives

• Sports playbook or book club references. Mitigation: Require IT-specific terms like SOP, escalation, or incident procedure.