IT Runbook/Playbook

Identifies IT runbooks, operational/security playbooks, SOPs and work instructions that contain executable operational detail: numbered steps, shell/admin commands, or internal hosts and addresses. Titles alone are discovery-only.

Type

regex

Confidence

medium

Confidence justification

Medium confidence: titles are discovery-only; enforcement requires numbered steps, commands or hosts, and 85 adds a second structure and operational context.

Jurisdictions

global

Regulations

Criminal Code Act 1995 (Cth)

Frameworks

CIS Controls, DISP, ISO 27001, NIST CSF, SOC 2

Data categories

technology, security

Scope

narrow

Risk rating

4

Should match

• Runbook: restart the licensing service (APP-LIC) Host: lic-app02.example.internal (10.40.2.18) Step 1: Put the node into maintenance mode in the load balancer. Step 2: Run sudo systemctl restart flexlm and confirm the service is active. Expected output: active (running). If the service fails twice, escalate to the platform on-call engineer. — High tier (85) - host, numbered steps and command with expected output/escalation
• Standard operating procedure for month-end backups - Step 1: confirm the previous job completed before starting the new run. — Medium tier (75) - numbered step only
• SOC playbook for phishing triage: pull headers with Get-MessageTrace before contacting the user. — Medium tier (75) - admin command only
• The new starter was pointed to the runbook on the team wiki. — Discovery tier (65) - title only

Should not match

• Guidance note: a good runbook lists prerequisites, numbered steps and an escalation path; agencies should review runbooks each year. — Guidance text
• Runbook template Service: ______ Host: ______ Step 1: ______ Step 2: ______ — Blank template
• Training module: learners follow a runbook to restart a demo web server using systemctl restart nginx. — Training framing with a command must not enforce
• The coach drew up a new playbook for the grand final. — Sports playbook - not an IT playbook

Known false positives

• Sports, marketing and Ansible playbooks and runbook-writing guidance. Mitigation: Playbook requires an incident/security/SOC/on-call/IT operations/support qualifier; enforcement needs populated steps, commands or hosts, and guidance/training/template framing is excluded.
• Overlap with global-top500-256-operational-runbooks, which uses the same structures. Mitigation: Deploy one of the two; merge recommended.

References

• ASD Information Security Manual (ISM)
• NIST SP 800-61r3 - Incident Response Recommendations and Considerations for Cybersecurity Risk Management