Perpetua ran the records desk for a mid-sized cardiac unit’s technology group, and her week changed the afternoon a colleague asked a simple question: “If someone opened a patient file they had no reason to open last month, would we be able to tell?” Nobody answered right away. The logs existed somewhere. Whether they were complete, readable and still around was another matter. That awkward silence is where SecDataOps begins, and this checklist is what she built afterwards.
SecDataOps is the engineering and care of security logs themselves, so that anyone who later investigates, audits or writes alert rules can rely on a record trail with no holes, that nobody doubts and that the budget survives. It does not decide what counts as an attack, and it does not protect the patient data directly. It looks after the evidence trail. If that sounds like plain old log management, you are not far off, and the Atlas says as much, which I will come back to below. This piece stays on the administrative side: no clinical content, no advice, just the paperwork of keeping a trail intact.
Why a hospital-side checklist helps
A heart surgery programme runs on handovers: a referral from one desk, an appointment confirmed by another, discharge papers prepared by a third. Each handover leaves traces in some system. When a record is touched without reason, those traces are the only witness. A checklist turns the vague hope that “the logs are fine” into something a person can tick, date and sign.
Readers who follow our posts on the way video follow-ups fit into recovery after cardiac operations will recognise a similar pattern: remote steps work only when every link in the chain is accounted for. Evidence works the same way.
The audit, item by item
1. Write down every source
Perpetua began with a plain register of every system that could record who did what: appointment software, the file server, the mailbox platform, badge readers, the remote-access gateway, the printers that scan to email. Beside each she wrote a grade from nought to five, borrowing the idea from a well-known technique-coverage exercise. Nought meant nothing collected; five meant complete and timely.
2. Score five dimensions, not one
One grade hides too much. The Ops Atlas entry proposes judging a feed on how many devices it covers, how many fields arrive filled in, how quickly, how consistently, and how long it is held. A source that covers every workstation but arrives six hours late scores differently from one that is instant but drops the username. Splitting the score showed her team exactly where to spend its limited week.
3. Give each source a one-page contract
For each important source she drafted a short sheet naming the owner, the fields that cannot be blank, the acceptable delay, the storage period, the running cost and any gaps already admitted. A named owner is the line people skip and the one that matters most; when a feed breaks at midnight, “someone in IT” is nobody.
4. Plant a canary
Think of a canary as a tame, easily recognised test event that a dummy account fires off every so often. If the canary stops showing up downstream, the feed is broken even though nothing screamed. This catches the quiet failures that dashboards happily average away.
5. Hold a silence test
Every few weeks, deliberately gag a test feed in the lab and time how long passes before anyone, human or machine, reacts. The Atlas sketches sample targets, roughly five minutes of lag for nearly all events and a page after fifteen quiet minutes; read these as illustrations and fit them to your own volumes.
6. Check how long logs live
Many tools keep ninety days by default, and that figure gets mistaken for a standard. It is not one. Public guidance on event logging asks for far longer, and the Atlas cites annual-scale minimums for the high-value records. If an intrusion goes unnoticed for months, a ninety-day window means the earliest evidence is gone before anyone looks.
7. Keep the raw copy
Parsing code gets things wrong, and target formats shift from one version to the next. So the untouched original goes into the cheapest storage tier, and the cleaned, normalised copy is built forward from it. Throwing away the raw version after normalising is listed among the classic anti-patterns.
8. Look at the change log, too
One runbook story in the Atlas is almost embarrassingly ordinary: a routine system upgrade silently switched off name-lookup logging on two machines, while renewed client certificates cut off another pair, and none of it passed the change board. Perpetua added a line to her list: after any upgrade, confirm that the feeds still arrive.
What she found
The first pass was humbling. Three sources had no owner, one had been silent for weeks, and the printer-scan logs were being kept for exactly as long as the default allowed. Nothing dramatic had happened; the gaps had simply never been looked for. By the end of the month the register held twenty-odd rows, ten of them with contracts, and the quietest feed had an owner who now received a message instead of a surprise.
A reference worth reading
The structure above leans on the vocabulary in the Ops Atlas entry describing SecDataOps. Per the Atlas, the label is an emerging, vendor-driven one, no standards body defines it, and governments have long described the same work as log management. That honesty is useful: you can adopt the practice without buying into any particular product story.
Keeping the evidence affordable
The word “affordable” in the definition is not decoration. Hot, searchable storage is expensive, and records departments tend to feel it the moment someone asks for a year of history. The Atlas walks through an example where a large firewall stream is summarised for fast searching while the full raw copy sits in a cheap lake for far longer. The daily cost drops sharply, and the retention period actually grows. The lesson for a unit like Perpetua’s is modest: ask what each stream costs per day before deciding to trim it, and test that nothing you rely on breaks when you do.
Your own one-page version
- List every system that records user activity and give each a named owner.
- Rate every source from nought to five against those yardsticks.
- Write a contract sheet for the ten most important sources.
- Plant a canary on each of them and watch for it downstream.
- Run a silence test once a month and record the minutes it takes.
- Set retention on purpose and keep the raw copy somewhere cheap.
- Re-check feeds after every upgrade or certificate change.
This article is general information about record-keeping and technology administration, not medical, legal or compliance advice. If you work in a regulated setting, your own policies and advisers decide what applies to you.
Perpetua still keeps her register pinned beside the monitor. When her colleague asked the same question again a quarter later, she opened the sheet and answered in a minute, which was the whole point.