Runbooks¶
Operational playbooks for running SnowOps engagements end to end — onboarding a client, signing off delivery via manual test runbooks, responding to incidents and disasters, importing brownfield environments, and offboarding cleanly when an engagement ends.
Where to start¶
| If you need to… | Go to |
|---|---|
| Stand up a new client's Azure landing zone | Client Onboarding — Phase 0 |
| Run the manual sign-off sequence for an asset delivery | Sequencing & Sign-Off Order, then the Manual Test Runbooks |
| Respond to a live security incident | Incident Response |
| Recover from a region/service loss | Disaster Recovery |
| Run a team incident-response rehearsal | Tabletop Exercises |
| Bring an existing (brownfield) environment under management | Brownfield Import — F12 |
| Manage or expedite a production change | Change Management |
| Handle a data-subject access/deletion request | Privacy & DSAR |
| Wind down an engagement | Offboarding |
Sections¶
-
Sequencing & Sign-Off Order — the canonical phase-by-phase execution order for the manual test runbooks, with dependency flow and time estimates. Currently 7 of 84 tracked assets signed off (D1 ✅, R1 ✅, C4 ✅, D3 ✅, V2 ✅, V3 ✅, S1 🟨 offline only).
-
Client Onboarding — Phase 0 Azure cloud setup: credentials, local tooling, and sandbox validation. Required before any test runbook can run.
-
Manual Test Runbooks — 80+ asset-by-asset test runbooks (
A1–X8) used to promote each asset from Code Complete to Shipped. Alphabetical index with links to every individual runbook. -
Incident Response — five incident-class playbooks (Account Compromise, Data Leak, DDoS, Ransomware, Vendor/Supply-Chain Breach), each following Identification → Containment → Eradication → Recovery → Post-Incident.
-
Disaster Recovery — DR plan template and four scenario runbooks (region failover, full region loss, SQL failover, point-in-time data restore).
-
Tabletop Exercises — five facilitated discussion-based rehearsals (K5), one per incident class, with facilitation guide, scoring rubric, and after-action template. Run quarterly for prod clients.
-
Change Management — the two change-approval paths: normal CAB pre-approval (R4) and the emergency break-glass path (R3) with mandatory retrospective review within 5 business days.
-
Privacy & DSAR — GDPR (30-day) and CCPA (45-day) data-subject access, deletion, and portability request workflow, with per-request evidence record template.
-
Brownfield Import — config-driven Terraform import blocks for adopting pre-existing Azure resources under SnowOps management (F12 import library).
-
Offboarding — the eight-phase W4 playbook for ending an engagement: evidence freeze, knowledge transfer, identity teardown, repo hand-back, state/secrets transfer, cost reassignment, optional decommission, and final attestation.
See also docs/context/00-asset-glossary.md for code → name lookups across
all of the above.