The practice model

Name the decision owner

Every security exception, risk acceptance and material architecture decision has one accountable owner.

Discipline: Metsuke·Perceive

Use named privileged access

Eliminate shared administrative identities. Record who elevated, what they accessed and when the privilege ended.

Discipline: Tate·Protect

Record security decisions

Keep a decision record for significant changes, exceptions and risk acceptances.

Discipline: Katana·Analyse

Define ownership

Every critical security control has an accountable owner and an operational owner.

Discipline: Metsuke·Perceive

Make escalation explicit

Define who must be informed when a security decision exceeds the team's authority.

Discipline: Metsuke·Perceive

Time-bound exceptions

Every exception has a reason, risk owner, compensating control and expiry date.

Discipline: Tate·Protect

Review consequential changes

Require independent review for high-impact firewall, identity, security-policy and production changes.

Discipline: Tate·Protect

Separate approval from execution

Where risk warrants it, the person implementing a sensitive action should not be the sole person approving it.

Discipline: Tate·Protect

Preserve audit trails

Ensure administrative actions cannot be altered or deleted by the same identity that performs them.

Discipline: Katana·Analyse

Formalise risk acceptance

Define who can accept which level of security risk and for how long.

Discipline: Metsuke·Perceive

Audit attribution

Periodically test whether consequential administrative actions can actually be attributed to an individual.

Discipline: Katana·Analyse

Measure stale exceptions

Track exceptions past their review or expiry date.

Discipline: Zanshin·Remain aware

Review shared accounts

Search for shared, generic and service identities that create attribution gaps.

Discipline: Metsuke·Perceive

Test decision records

Sample architecture and security decisions and verify that the stated owner, evidence and approval exist.

Discipline: Katana·Analyse

Report accountability gaps

Include unattributed privileged activity and overdue ownership actions in security reporting.

Discipline: Zanshin·Remain aware

Learn from accountability failures

Use incidents and near misses to identify where responsibility was unclear.

Discipline: Zanshin·Remain aware

Reduce manual attribution

Automate identity correlation across PAM, IAM, SIEM and infrastructure platforms.

Discipline: Katana·Analyse

Reassess authority boundaries

Review whether decision rights still match the organisation's current architecture and operating model.

Discipline: Zanshin·Remain aware

Challenge risk acceptance

Periodically review recurring accepted risks and determine whether the organisation has normalised them.

Discipline: Zanshin·Remain aware

Make accountability part of architecture

Design new platforms so that identity, action and evidence remain linked by default.

Discipline: Tate·Protect

Define escalation thresholds

Give analysts clear conditions under which suspicious activity must be escalated.

Discipline: Katana·Analyse

Run basic threat hunts

Regularly investigate behaviours that existing detections may miss.

Discipline: Katana·Analyse

Establish incident authority

Define who can isolate a device, disable an account or block traffic during an incident.

Discipline: Tate·Protect

Create challenge points

Require security review for architectures and changes that introduce material exposure.

Discipline: Metsuke·Perceive

Document uncertainty

Allow incident teams to record hypotheses as hypotheses instead of forcing premature conclusions.

Discipline: Katana·Analyse

Exercise incident response

Run tabletop and technical exercises where information is deliberately incomplete.

Discipline: Tate·Protect

Maintain hunting hypotheses

Turn intelligence, incidents and unusual telemetry into repeatable hunting questions.

Discipline: Metsuke·Perceive

Define containment playbooks

Pre-authorise common containment actions so teams do not need to negotiate authority during an incident.

Discipline: Tate·Protect

Establish independent escalation

Allow analysts to escalate significant concerns without requiring approval from the team being investigated.

Discipline: Katana·Analyse

Protect useful challenge

Create a process for challenging high-risk decisions without turning disagreement into personal conflict.

Discipline: Metsuke·Perceive

Measure detection-to-investigation time

Track how quickly suspicious signals receive meaningful investigation.

Discipline: Katana·Analyse

Measure investigation outcomes

Record how many hunts produce new detections, vulnerabilities, compromised assets or useful negative findings.

Discipline: Katana·Analyse

Test blind spots

Periodically simulate activity that existing detection rules should not identify.

Discipline: Metsuke·Perceive

Review closed alerts

Sample alerts closed as benign and test whether the reasoning was sound.

Discipline: Katana·Analyse

Track delayed escalation

Identify incidents where evidence existed but action was delayed.

Discipline: Zanshin·Remain aware

Turn hunts into detections

Convert repeatable hunting discoveries into automated or semi-automated detection.

Discipline: Zanshin·Remain aware

Feed incidents into architecture

Use recurring investigation findings to change identity, network, endpoint and application design.

Discipline: Zanshin·Remain aware

Rehearse decision-making under pressure

Run exercises where business impact and incomplete evidence compete for attention.

Discipline: Tate·Protect

Challenge detection assumptions

Regularly ask what the SOC cannot currently see and what an attacker could do without generating an alert.

Discipline: Metsuke·Perceive

Reward justified intervention

Recognise analysts and engineers who escalate credible concerns early, including cases that ultimately prove benign.

Discipline: Zanshin·Remain aware

Identify the user

For every important control, identify who operates it and what legitimate task they need to complete.

Discipline: Metsuke·Perceive

Document the secure path

Make the approved way to perform common tasks clear and accessible.

Discipline: Tate·Protect

Provide a security support path

Give users a practical way to resolve security-related blockers.

Discipline: Tate·Protect

Make reporting easy

Provide simple mechanisms for reporting phishing, lost devices, suspicious activity and accidental exposure.

Discipline: Zanshin·Remain aware

Explain the reason

Tell users what a control protects and what behaviour is expected.

Discipline: Tate·Protect

Automate the safe path

Automate access requests, credential rotation, approved software deployment and similar repetitive tasks.

Discipline: Tate·Protect

Design with users

Test security workflows with administrators, developers and business users before deployment.

Discipline: Metsuke·Perceive

Build approved alternatives

When blocking a risky activity, provide a supported way to accomplish the legitimate business requirement.

Discipline: Tate·Protect

Measure friction

Track access-request time, authentication failures, exception requests and security-related support demand.

Discipline: Katana·Analyse

Review workarounds

Treat repeated bypasses as signals that the control or process needs examination.

Discipline: Zanshin·Remain aware

Measure abandonment

Identify security workflows that users start but do not complete.

Discipline: Katana·Analyse

Track exception demand

Look for teams repeatedly requesting the same exception.

Discipline: Zanshin·Remain aware

Measure secure-path adoption

Determine whether users actually use the approved workflow.

Discipline: Katana·Analyse

Test usability after deployment

Reassess controls after major changes in technology or business processes.

Discipline: Zanshin·Remain aware

Correlate friction with incidents

Look for relationships between difficult controls and unsafe workarounds.

Discipline: Katana·Analyse

Remove recurring friction

Prioritise engineering work that eliminates repeated security workarounds.

Discipline: Tate·Protect

Use risk-based controls

Apply stronger controls where risk requires them and reduce unnecessary friction elsewhere.

Discipline: Tate·Protect

Continuously redesign workflows

Treat security user experience as an operational product that needs maintenance.

Discipline: Zanshin·Remain aware

Automate exception alternatives

Where the same exception appears repeatedly, determine whether it should become a supported pattern.

Discipline: Zanshin·Remain aware

Measure security by behaviour

Include user adoption and workaround rates when evaluating whether a control is successful.

Discipline: Katana·Analyse

Define access requirements

Document what access each role actually requires.

Discipline: Metsuke·Perceive

Identify trust boundaries

Document important identity, network, application and data boundaries.

Discipline: Metsuke·Perceive

Establish access owners

Every sensitive resource has an owner responsible for access decisions.

Discipline: Metsuke·Perceive

Classify sensitive information

Define which information requires additional access restrictions.

Discipline: Metsuke·Perceive

Establish temporary-access rules

Define how project, vendor, emergency and privileged access is granted and removed.

Discipline: Tate·Protect

Review privileged access

Regularly remove access that is no longer required.

Discipline: Tate·Protect

Expire temporary access

Make temporary access expire automatically wherever possible.

Discipline: Tate·Protect

Enforce least privilege

Grant access according to role, task and necessity.

Discipline: Tate·Protect

Separate duties

Prevent one person from controlling sensitive approval and execution paths where risk warrants it.

Discipline: Tate·Protect

Enforce segmentation

Restrict communication between systems according to documented requirements.

Discipline: Tate·Protect

Test access paths

Verify that users cannot reach resources outside their intended scope.

Discipline: Katana·Analyse

Test segmentation

Verify that prohibited network paths are actually blocked.

Discipline: Katana·Analyse

Measure excessive privilege

Identify users, service accounts and applications with broader access than required.

Discipline: Metsuke·Perceive

Review stale vendor access

Track external identities that remain active beyond their business need.

Discipline: Zanshin·Remain aware

Audit access exceptions

Measure how many access decisions bypass the normal process.

Discipline: Katana·Analyse

Move toward continuous authorisation

Reassess access based on identity, device, context and resource sensitivity.

Discipline: Zanshin·Remain aware

Reduce standing privilege

Replace permanent access with just-in-time or task-based access where appropriate.

Discipline: Tate·Protect

Revalidate trust boundaries

Review segmentation and access models when applications, organisations or infrastructure change.

Discipline: Zanshin·Remain aware

Automate entitlement removal

Connect joiner-mover-leaver events to access removal.

Discipline: Tate·Protect

Treat access as a lifecycle

Design access from creation through review to removal rather than as a one-time approval.

Discipline: Zanshin·Remain aware

Define authoritative sources

Identify which system is authoritative for assets, identities, vulnerabilities, configurations and other security data.

Discipline: Metsuke·Perceive

Define data ownership

Assign owners to important security datasets.

Discipline: Metsuke·Perceive

Record freshness

Make the age of security data visible.

Discipline: Zanshin·Remain aware

Distinguish unknown from compliant

Do not treat missing telemetry as a passing result.

Discipline: Katana·Analyse

Document measurement limits

State what each security metric includes and excludes.

Discipline: Katana·Analyse

Reconcile inventories

Compare CMDB, cloud inventories, endpoint platforms, vulnerability scanners and network discovery.

Discipline: Metsuke·Perceive

Monitor security telemetry

Detect when log sources, agents, scanners or integrations stop reporting.

Discipline: Zanshin·Remain aware

Validate critical metrics

Check the underlying data behind important dashboards.

Discipline: Katana·Analyse

Protect security records

Restrict modification and deletion of logs, evidence and audit records.

Discipline: Katana·Analyse

Establish data-quality workflows

Assign discrepancies to owners and track them to resolution.

Discipline: Zanshin·Remain aware

Measure inventory coverage

Track the percentage of assets represented across required security systems.

Discipline: Metsuke·Perceive

Measure telemetry coverage

Track which critical systems are actually producing the expected logs.

Discipline: Metsuke·Perceive

Measure data freshness

Identify security data that has become too old to support decisions.

Discipline: Zanshin·Remain aware

Sample compliance claims

Test whether reported compliance matches actual configuration.

Discipline: Katana·Analyse

Track reconciliation gaps

Measure recurring differences between authoritative and operational datasets.

Discipline: Zanshin·Remain aware

Automate reconciliation

Continuously compare inventories and security platforms.

Discipline: Zanshin·Remain aware

Detect silent failure

Alert when a security control stops producing expected evidence.

Discipline: Zanshin·Remain aware

Propagate data quality

Prevent incomplete or stale source data from being presented as authoritative downstream.

Discipline: Tate·Protect

Link metrics to evidence

Allow important security claims to be traced back to the underlying records.

Discipline: Katana·Analyse

Make uncertainty operational

Use confidence and coverage information when prioritising security decisions.

Discipline: Metsuke·Perceive

Define internal standards

Set security expectations that are clear and operational.

Discipline: Tate·Protect

Assign control owners

Give every important control a responsible owner.

Discipline: Metsuke·Perceive

Define evidence

Specify what demonstrates that a control operates.

Discipline: Katana·Analyse

Define control frequency

State how often important controls must operate or be tested.

Discipline: Tate·Protect

Record known failures

Create a visible process for reporting controls that do not work.

Discipline: Zanshin·Remain aware

Run continuous assurance

Test important controls throughout the year.

Discipline: Zanshin·Remain aware

Track control degradation

Monitor controls as systems, ownership and integrations change.

Discipline: Zanshin·Remain aware

Fix internally discovered issues

Do not wait for an audit or regulator to identify known weaknesses.

Discipline: Tate·Protect

Review standards

Update standards when architecture, threats or business processes change.

Discipline: Zanshin·Remain aware

Separate compliance from security

Track regulatory compliance and internal security objectives separately.

Discipline: Metsuke·Perceive

Measure control effectiveness

Measure whether controls produce the intended result, not only whether they exist.

Discipline: Katana·Analyse

Track overdue assurance

Monitor controls that have not been tested on schedule.

Discipline: Zanshin·Remain aware

Measure recurring findings

Identify weaknesses that repeatedly appear in audits and assessments.

Discipline: Zanshin·Remain aware

Report control failures

Include failed controls in management reporting.

Discipline: Katana·Analyse

Compare internal and external findings

Identify problems that internal assurance should have found earlier.

Discipline: Katana·Analyse

Raise the internal standard

Increase expectations when the organisation can support them and the risk warrants it.

Discipline: Tate·Protect

Automate control assurance

Use technical evidence where possible instead of manual evidence collection.

Discipline: Katana·Analyse

Remove recurring control failures

Treat repeated findings as process or architecture problems.

Discipline: Zanshin·Remain aware

Challenge accepted weaknesses

Review whether long-standing accepted risks are still justified.

Discipline: Zanshin·Remain aware

Test before the audit

Use internal assurance to establish the actual state before external scrutiny arrives.

Discipline: Katana·Analyse

Assign system ownership

Every important system has a named business or technology owner.

Discipline: Metsuke·Perceive

Define security responsibilities

Make security duties part of relevant roles.

Discipline: Metsuke·Perceive

Teach intervention

Tell people what to do when they see suspicious activity or unsafe behaviour.

Discipline: Zanshin·Remain aware

Provide reporting mechanisms

Make reporting accessible without requiring specialist knowledge.

Discipline: Zanshin·Remain aware

Define stewardship expectations

Make clear what responsibility comes with privileged or sensitive access.

Discipline: Tate·Protect

Include security in role definitions

Make security responsibilities explicit for administrators, developers, engineers and system owners.

Discipline: Metsuke·Perceive

Review responsibility with access

When sensitive access is renewed, confirm the user's continuing responsibility.

Discipline: Tate·Protect

Build security into operational processes

Include security checks in deployment, onboarding, change and decommissioning workflows.

Discipline: Tate·Protect

Establish vendor responsibility

Define security responsibilities for third parties with access to company systems.

Discipline: Metsuke·Perceive

Support responsible reporting

Ensure employees can report mistakes and suspicious activity without first resolving the issue themselves.

Discipline: Zanshin·Remain aware

Measure ownership coverage

Track systems and controls without an accountable owner.

Discipline: Metsuke·Perceive

Measure reporting behaviour

Track useful reports of phishing, suspicious activity and control failures.

Discipline: Zanshin·Remain aware

Measure unresolved ownership

Identify security issues waiting because responsibility is unclear.

Discipline: Metsuke·Perceive

Review privileged stewardship

Sample privileged users and verify that access remains justified and understood.

Discipline: Katana·Analyse

Measure security participation

Track participation in exercises, training and operational security activities.

Discipline: Zanshin·Remain aware

Push responsibility toward the edge

Move appropriate security decisions closer to the teams operating the systems.

Discipline: Tate·Protect

Integrate security into engineering

Make security part of normal engineering workflows rather than a separate approval stage.

Discipline: Tate·Protect

Use incidents to clarify ownership

Where an incident exposes responsibility gaps, change the operating model.

Discipline: Zanshin·Remain aware

Build security into performance expectations

Where appropriate, include security responsibilities in team and role objectives.

Discipline: Tate·Protect

Treat privilege as stewardship

Review whether privileged access is still supported by the responsibility that justified it.

Discipline: Zanshin·Remain aware

Define change classes

Distinguish normal, standard, emergency and high-risk changes.

Discipline: Tate·Protect

Establish emergency procedures

Define what can be changed during an incident and who can authorise it.

Discipline: Tate·Protect

Record privileged actions

Capture administrative activity in critical environments.

Discipline: Katana·Analyse

Define temporary exceptions

Give temporary changes and exclusions an explicit end condition.

Discipline: Tate·Protect

Establish rollback expectations

Define how high-impact changes can be reversed.

Discipline: Tate·Protect

Use just-in-time privilege

Grant elevated access for the task and remove it when the task ends.

Discipline: Tate·Protect

Require peer review

Use independent review for high-impact changes where risk warrants it.

Discipline: Tate·Protect

Automate expiry

Automatically remove temporary firewall rules, exclusions, privileges and exceptions where possible.

Discipline: Tate·Protect

Protect emergency access

Log and restrict emergency administrative capabilities.

Discipline: Tate·Protect

Use infrastructure as code

Prefer controlled, repeatable changes over undocumented manual modification.

Discipline: Tate·Protect

Measure emergency changes

Track how often emergency procedures are used.

Discipline: Zanshin·Remain aware

Measure rollback

Track changes that require rollback and identify recurring causes.

Discipline: Katana·Analyse

Measure standing privilege

Identify elevated access that remains active beyond operational need.

Discipline: Metsuke·Perceive

Audit temporary controls

Find expired exceptions, exclusions and temporary rules that remain active.

Discipline: Zanshin·Remain aware

Review manual changes

Identify production changes performed outside approved mechanisms.

Discipline: Katana·Analyse

Reduce emergency demand

Use recurring emergency changes to identify weaknesses in architecture or process.

Discipline: Zanshin·Remain aware

Automate controlled remediation

Where the action is predictable, make the safe response repeatable.

Discipline: Tate·Protect

Improve rollback capability

Invest in reversible deployments and configuration recovery where failure has material impact.

Discipline: Tate·Protect

Design for pressure

Test whether security processes still work during outages, incidents and high business pressure.

Discipline: Tate·Protect

Learn from exceptions

Treat repeated emergency behaviour as evidence that the normal operating model needs to change.

Discipline: Zanshin·Remain aware