Cybersecurity Operations Centre

Rationale: Purple team exercises are the only verification method that validates the end-to-end detection pipeline under realistic adversary conditions — from initial access through exfiltration. Quarterly cadence ensures detection coverage is verified after each detection rule update cycle. The 20-technique minimum across 5 ATT&CK tactic categories ensures breadth of coverage testing, not just depth against a single attack chain.

Rationale: SYS-REQS-017 introduces a degraded-mode detection requirement that must be verified independently of the quarterly purple team exercises (VER-METH-001). Failover testing validates both the SIEM HA architecture and the bypass alert paths from EDR/NSM/IAM to SOAR. Without dedicated failover exercises, the degraded-mode capability may exist on paper but fail under actual SIEM outage conditions.

Rationale: The verification plan currently covers only quarterly purple team exercises (VER-METH-001), which test detection effectiveness but not integration health. Monthly automated integration tests catch regression in inter-subsystem interfaces (message queue connectivity, API schema changes, TLS certificate expiry) before they impact real incident response. This mirrors the hospital patient monitoring approach where integration tests run continuously on the alerting pipeline.

Rationale: Multiple requirements specify data retention periods (SYS-DATA-006, REQ-SECYBERSECOPSCENTRE-003, REQ-005) and regulatory notification generation (SYS-DATA-009), but no verification activity confirms these capabilities are maintained over time. Storage tier migration, schema changes, or capacity pressure can silently break retention compliance. Quarterly audit frequency aligns with the 90-day hot retention window, ensuring at least one audit covers each retention boundary.

Rationale: The response pipeline spans EDR containment (REQ-007), SOAR playbook execution (REQ-004/005), and SOAR-to-EDR/NSM command interfaces (IFC-004, IFC-010). Without end-to-end response testing, individual subsystem tests may pass while the integrated containment workflow fails under realistic incident conditions. Quarterly tabletop plus semi-annual live test balances operational disruption against verification confidence.

Rationale: Network monitoring (REQ-009) and identity monitoring (REQ-010) are passive detection subsystems whose effectiveness degrades silently — a missing sensor or drifted UEBA baseline produces no visible failure signal. Periodic coverage audits and accuracy assessments are the only way to maintain confidence that these subsystems are detecting threats across the full monitored surface.

Rationale: The TIP subsystem (REQ-008) and its interfaces to SIEM (IFC-003) and SOAR (IFC-009) form a critical enrichment chain — without current intelligence, SIEM correlation operates on signatures alone and SOAR playbooks lack threat context for triage prioritisation. Feed health degrades silently (expired API keys, deprecated endpoints), so proactive verification is essential.