24
Published and approved standard operating procedures
Approved SOP Catalog
These are governed procedures that define repeatable execution standards, not informal guidance or incident-specific decision paths.
| Procedure | Owner | Governance State | Linked Assets |
|---|---|---|---|
| SOP-101 Access Provisioning Standard Procedure v4.3 Standard workflow for routine onboarding, offboarding, and role-based access changes. |
Identity service owner | Approved | Quarterly review | Last approved May 2026 | Approvals + Training + Audit |
| SOP-208 Daily Public Data Refresh Validation v2.8 Repeatable validation and publish-readiness procedure for public-facing reporting refreshes. |
Data platform lead | Approved | Monthly review | Last approved Apr 2026 | Change Risk + Training + Audit |
| SOP-317 Vendor Escalation Intake Procedure v3.1 Controlled intake for when and how vendor escalations should be opened, evidenced, and tracked. |
Vendor manager | Approved | Semiannual review | Last approved Mar 2026 | Reference + Vendors + Audit |
| SOP-411 Planned Change Readiness Procedure v5.0 Readiness, rollback, communication, and sign-off expectations for planned service changes. |
Change authority | Approved | Quarterly review | Last approved May 2026 | Changes + Approvals + Training |
Procedure Governance Lifecycle
SOPs should move through a formal lifecycle so teams know what is approved, what changed, and what version applies.
Draft Or Revise
Create or update the procedure with scope, prerequisites, roles, checkpoints, and required evidence.
→
Review Impact
Validate operational fit, risk, approval implications, and whether linked training or audit content must also change.
→
Approve And Publish
Record approver, version, publish date, and formal effective date before the procedure becomes active.
→
Train And Adopt
Link the procedure to enablement assets, role expectations, and implementation checkpoints.
→
Audit And Renew
Review evidence, capture deviations, and re-approve or revise the procedure on schedule.
What SOP Is And Is Not
The platform should separate internal context, formal procedure, and live execution on purpose.
| Surface | Primary Purpose | Governance Model | When To Use |
|---|---|---|---|
| Reference Library | Preserve internal context, history, architecture notes, lessons learned, and vendor knowledge. | Stewarded internal content with review expectations, but not formal execution control. | Use when teams need context, background, or institutional memory. |
| SOP Governance Library | Define approved, repeatable procedures with clear roles, checkpoints, versioning, and compliance expectations. | Versioned, approved, review-controlled, training-linked, and audit-verifiable. | Use when recurring work must be executed consistently and defensibly. |
| Runbook | Guide live execution during operational events or incidents under active conditions and triggers. | Triggered execution artifact with approvals, stop conditions, and live write-back requirements. | Use during an active operational scenario when the event and execution path are already underway. |
Example Governed Procedures
Formal procedures should make prerequisites, checkpoints, and evidence expectations explicit before work begins.
Approved
Access Provisioning Standard Procedure
Routine identity and access work executed under least-privilege and approver confirmation rules.
Prerequisites
Tracked request, business owner, start and end dates, and validated approver.
Checkpoints
Least-privilege confirmation, segregation review, and completion evidence before close.
Approved
Daily Public Data Refresh Validation
Repeatable procedure for validating data quality and publish-readiness before external refresh.
Prerequisites
Source refresh complete, exception thresholds loaded, and validation dataset available.
Checkpoints
Publish hold if validation exceptions exceed threshold or if owner sign-off is missing.
Approved
Vendor Escalation Intake Procedure
Controlled procedure for entering vendor escalation with evidence, service impact, and contract path clarity.
Prerequisites
Severity confirmed, service owner named, and evidence packet assembled.
Checkpoints
Escalation path validated, vendor expectation set, and timeline logged for audit.