Infrastructure for Incident Response Automation (SOAR)

Highest formality due to compliance requirements (SOC 2, ISO 27001, GDPR). Security policies documented. Access controls defined. Incident response procedures written. Audit evidence systematically collected. But security culture (why we do this) and threat intelligence less formal. Compliance-driven documentation comprehensive. Strategic security thinking (threat modeling, risk assessment reasoning) less formalized. Security team underwater, documentation competes with operations.

Security events comprehensively logged (SIEM requirement). Access attempts tracked. Vulnerabilities scanned continuously. Compliance activities logged (training completion, policy acknowledgment). But security discussions, risk decisions, threat intelligence analysis often not captured. Technical security events comprehensively captured. Strategic security context (why we accepted this risk, how we prioritized remediation) captured sporadically.

Security controls mapped to frameworks (SOC 2, ISO 27001). Vulnerability data structured (CVSS scores, severity). Asset inventory organized. GRC platforms enforce structure. But threat intelligence, incident learnings, risk assessments often unstructured. Compliance frameworks provide structure. Operational security less structured. Each security tool has own taxonomy (no unified ontology). Threat data scattered.

Security tools have APIs (SIEM, vulnerability scanners, IAM). Compliance platforms expose data. But security data tightly controlled (need-to-know). Logs voluminous but require expertise to query. GRC platforms have APIs but adoption varies. Security/compliance restrictions limit access. Logs accessible but cryptic (need domain expertise). Security team protective of data (breach risk).

Compliance forces regular updates (annual SOC 2 audit, quarterly reviews). Vulnerability databases refreshed daily. Security policies reviewed annually (required). Access controls reviewed quarterly. But threat models not updated continuously. Security architecture docs lag reality. Compliance-driven maintenance rigorous. Strategic security artifacts (threat models, architecture) maintained ad-hoc unless forced by incident/audit.

SIEM integrates logs from multiple sources. IAM connects to all apps (SSO). GRC platform pulls evidence from various systems. But security data doesn't flow back to operations. Vulnerability findings don't auto-create engineering tickets. Security as monitoring function, not integrated layer. Security tools integrate inbound (collect data) but don't integrate outbound (push to operations). Security team manually bridges to engineering/ops. "Security as separate function" not "security integrated into delivery."