Procedures are detailed, *step-by-step processes that individuals and organisations must follow in specific circumstances*. Similar to checklists, procedures ensure a consistent process for achieving a security objective. Organisations may create procedures for *building new systems, releasing code to production environments, responding to security incidents*, and many other tasks. Compliance with procedures is mandatory. Organisations commonly include the following procedures in their policy frameworks: - **Change management procedures** that describe how the organization will perform change management activities that comply with the organisation's [[Change Management]] policy, including the possible use of version control and other tools - **Onboarding and off-boarding procedures** that describe how the organization will add new user accounts as employees join the organization and how those accounts will be removed when no longer needed - **Playbooks** that describe the actions that the organisation's incident response team will take when specific types of incidents occur Of course, cybersecurity teams may decide to include many other types of procedures in their frameworks, as dictated by the organisation's operational needs.