Standard Operating Procedure (SOP) for Turn Around Time (TAT) for Threat Management

A standardized approach for responding to threats identified in the Techowl Shield platform, ensuring timely mitigation based on severity levels — applicable to all clients.

Objective

To define a standardized approach for responding to threats identified in the Techowl Shield platform, ensuring timely mitigation based on severity levels.

Scope

This SOP applies to all threats reported or detected within the Techowl Shield system and categorizes them based on severity levels to ensure proper turnaround time (TAT) for response and resolution by the clients.

Definitions

Term	Definition
Threat	Any malicious activity, security vulnerability, or unauthorized access that may harm systems, data, or users.
Turnaround Time (TAT)	The maximum allowable response and resolution time for a reported threat based on severity level.
Severity Levels	Categorization of threats based on impact and urgency, ranging from Critical to Low.

Responsibilities

Party	Responsibilities
Client	Report security threats promptly with relevant details. Provide necessary access for mitigation actions. Categorize threats based on severity. Ensure timely investigation and resolution within the defined TAT. Maintain documentation and update records after resolution.
Senior Management	Oversee unresolved cases, provide necessary resources, and escalate critical threats if required.

Severity Classification and Turnaround Time (TAT)

Severity Level	Definition	Suggested TAT
Critical	Threats causing immediate and severe damage, such as data breaches, ransomware, or active exploitation.	12 hours
High	Significant security risks with potential impact on business operations, such as unauthorized access or malware infections.	24 hours
Medium	Moderate security risks requiring investigation, such as suspicious activities or policy violations.	48 hours
Low	Minor security risks or vulnerabilities with no immediate impact, such as outdated software versions or non-critical misconfigurations.	72 hours

Process Workflow

Threat Reporting
- Trigger: A security threat is reported via the Techowl Shield portal, email, or hotline.
- Required Information:
  - Description of the threat.
  - Affected system or service.
  - Any available logs or screenshots.
  - Impact assessment (if known).
Threat Assessment & Severity Classification
- Responsibility: Client
- Actions:
  - Analyze reported threat details.
  - Assign severity level based on predefined criteria.
  - Notify stakeholders and assign internal response team members.
Response & Mitigation
- Responsibility: Client's Internal Security Team
- Actions:
  - Initiate containment measures.
  - Conduct in-depth investigation.
  - Apply necessary fixes, patches, or mitigations.
  - Document all actions taken.
Follow-Up & Resolution Confirmation
- Responsibility: Client's Internal Security Team
- Actions:
  - Verify resolution effectiveness.
  - Conduct post-incident analysis.
  - Update documentation and incident logs.
  - Ensure the threat has been fully mitigated.
Closure & Reporting
- Trigger: Threat successfully mitigated and verified.
- Actions:
  - Update incident records.
  - Perform root cause analysis if necessary.
  - Generate a report summarizing incident response activities.