> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Your security & compliance runbooks

> The security owner's Skill Library toolkit: incident-response runbooks for phishing, BEC, ransomware, plus identity checks, SOC ops, and audit prep.

export const MarkComplete = ({id, signalDone = false}) => {
  const KEY = "thread-onboarding-completed";
  const read = () => {
    try {
      return JSON.parse(localStorage.getItem(KEY) || "[]");
    } catch (e) {
      return [];
    }
  };
  const [localDone, setLocalDone] = useState(false);
  const done = signalDone || localDone;
  useEffect(() => {
    const sync = () => setLocalDone(read().includes(id));
    sync();
    window.addEventListener("thread-onboarding-updated", sync);
    return () => window.removeEventListener("thread-onboarding-updated", sync);
  }, [id]);
  const toggle = () => {
    if (signalDone) return;
    const list = read();
    const next = list.includes(id) ? list.filter(x => x !== id) : [...list, id];
    try {
      localStorage.setItem(KEY, JSON.stringify(next));
    } catch (e) {}
    setLocalDone(next.includes(id));
    window.dispatchEvent(new Event("thread-onboarding-updated"));
  };
  return <button onClick={toggle} style={{
    width: "100%",
    padding: "0.7rem 1rem",
    marginTop: "1.5rem",
    borderRadius: "8px",
    border: "1px solid " + (done ? "#00B398" : "rgba(128,128,128,0.35)"),
    background: done ? "rgba(0,179,152,0.12)" : "transparent",
    color: done ? "#00B398" : "inherit",
    fontWeight: 600,
    fontSize: "0.95rem",
    cursor: "pointer",
    display: "flex",
    alignItems: "center",
    justifyContent: "center",
    gap: "0.5rem"
  }}>
      <span aria-hidden="true">{done ? "✓" : "○"}</span>
      {done ? "Completed" : "Mark as complete"}
    </button>;
};

export const ByRoleProgress = () => {
  useEffect(() => {
    const KEY = "thread-onboarding-completed";
    const TEAL = "#00B398";
    const BASE = "/start-here/roles/";
    const DONE_ICON = '<svg class="thread-rc-doneicon size-4" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="#00B398" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">' + '<path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/>' + '<polyline points="22 4 12 14.01 9 11.01"/></svg>';
    const COURSES = [{
      slug: "technician",
      steps: ["why-thread", "get-around-inbox", "day-one-setup", "daily-workflows", "ai-toolkit", "notifications-and-customers"]
    }, {
      slug: "dispatcher",
      steps: ["why-dispatch-in-thread", "read-the-board", "assign-and-schedule", "ai-for-dispatch"]
    }, {
      slug: "service-ops-manager",
      steps: ["set-up-the-desk", "sla-and-dispatch", "analytics-and-qa", "roll-out-and-adopt"]
    }, {
      slug: "csm-account-manager",
      steps: ["client-intelligence-and-health", "qbrs-and-reporting", "retention-and-expansion"]
    }, {
      slug: "security-compliance-owner",
      steps: ["security-work-in-thread", "data-and-compliance", "security-runbooks"]
    }, {
      slug: "sales-business-development",
      steps: ["the-ai-service-pitch", "quote-and-handoff"]
    }, {
      slug: "msp-owner-leadership",
      steps: ["the-rollout", "outcomes-and-analytics", "scale-ai-service"]
    }, {
      slug: "automation-engineer",
      steps: ["flows-and-intents", "thread-mcp-and-api", "build-with-super-magic"]
    }];
    const COURSE_SLUGS = new Set(COURSES.map(c => c.slug));
    const readLocal = () => {
      try {
        return JSON.parse(localStorage.getItem(KEY) || "[]");
      } catch (e) {
        return [];
      }
    };
    const isDone = (done, id) => done.includes(id);
    const decorate = () => {
      const done = readLocal();
      const scope = document.getElementById("sidebar-content") || document;
      const links = [...scope.querySelectorAll('a[href*="' + BASE + '"]')].filter(a => !a.closest("main"));
      links.forEach(a => {
        const m = (a.getAttribute("href") || "").match(/\/start-here\/roles\/([^/?#]+)\/([^/?#]+)/);
        if (!m) return;
        if (!COURSE_SLUGS.has(m[1])) return;
        const id = m[1] + "/" + m[2];
        const d = isDone(done, id);
        const has = a.querySelector(".thread-rc-check");
        if (d && !has) {
          const s = document.createElement("span");
          s.className = "thread-rc-check";
          s.textContent = "✓ ";
          s.style.color = TEAL;
          s.style.fontWeight = "700";
          a.insertBefore(s, a.firstChild);
        } else if (!d && has) {
          has.remove();
        }
      });
      COURSES.forEach(course => {
        const li = scope.querySelector('li[id="' + BASE + course.slug + '"]');
        if (!li) return;
        const row = li.querySelector(":scope > button") || li.querySelector(":scope > a") || li.firstElementChild;
        if (!row) return;
        const nameSpan = [...row.querySelectorAll("span")].find(s => s.textContent.trim() && !s.classList.contains("thread-rc-coursecheck"));
        if (!nameSpan) return;
        const allDone = course.steps.length > 0 && course.steps.every(s => isDone(done, course.slug + "/" + s));
        const has = nameSpan.querySelector(".thread-rc-coursecheck");
        if (allDone && !has) {
          const s = document.createElement("span");
          s.className = "thread-rc-coursecheck";
          s.setAttribute("aria-hidden", "true");
          s.style.display = "inline-flex";
          s.style.alignItems = "center";
          s.style.verticalAlign = "-0.2em";
          s.style.marginRight = "0.35em";
          s.innerHTML = DONE_ICON;
          nameSpan.insertBefore(s, nameSpan.firstChild);
        } else if (!allDone && has) {
          has.remove();
        }
      });
    };
    decorate();
    const iv = setInterval(decorate, 600);
    window.addEventListener("thread-onboarding-updated", decorate);
    window.addEventListener("storage", decorate);
    return () => {
      clearInterval(iv);
      window.removeEventListener("thread-onboarding-updated", decorate);
      window.removeEventListener("storage", decorate);
    };
  }, []);
  return null;
};

<ByRoleProgress />

Everything in the first two lessons — the ticket flow and the data model — turns into daily work here. The [Skill Library](/skill-library/overview) is your operational bench: prompt-first skills you run from Super Magic to investigate, respond, hand off, and prove the work. These are representative starting points; press **`⌘K`** in Inbox and search any threat or framework to find the rest.

## Incident response

The runbooks you reach for when something is actively wrong — each walks the containment, communication, and recovery steps so nothing gets skipped under pressure.

<CardGroup cols={2}>
  <Card title="Phishing Triage" icon="fish" href="/skill-library/security/phishing-triage">
    Assess a reported email and contain it if it's malicious.
  </Card>

  <Card title="Account Takeover Runbook" icon="user-lock" href="/skill-library/security/account-takeover-runbook">
    Full response for a compromised account, start to finish.
  </Card>

  <Card title="Business Email Compromise Recovery" icon="envelope-circle-check" href="/skill-library/security/business-email-compromise-recovery">
    Work a BEC from detection through recovery and verification.
  </Card>

  <Card title="Ransomware Response" icon="skull-crossbones" href="/skill-library/security/ransomware-response">
    Contain, communicate, and coordinate recovery.
  </Card>

  <Card title="Session Token Theft Response" icon="key" href="/skill-library/security/session-token-theft-response">
    Revoke, re-secure, and confirm after stolen-session activity.
  </Card>

  <Card title="Zero-Day Emergency Response" icon="triangle-exclamation" href="/skill-library/security/zero-day-emergency-response">
    Move fast on an unpatched, actively exploited vulnerability.
  </Card>
</CardGroup>

## Identity and access

The proactive checks that close the gaps attackers use before they get used.

<CardGroup cols={2}>
  <Card title="Identity & MFA Health Check" icon="fingerprint" href="/skill-library/security/identity-mfa-health-check">
    Find identity and MFA gaps across a client tenant.
  </Card>

  <Card title="Global Admin Audit" icon="user-shield" href="/skill-library/security/global-admin-audit">
    Review who holds the keys and why.
  </Card>

  <Card title="Impossible Travel Runbook" icon="plane-lock" href="/skill-library/security/impossible-travel-runbook">
    Work an impossible-travel sign-in to a verdict.
  </Card>

  <Card title="MFA Fatigue Attack Response" icon="bell-slash" href="/skill-library/security/mfa-fatigue-attack-response">
    Respond to push-bombing and re-secure the account.
  </Card>
</CardGroup>

## Alerts and vendor signal

Turn the alert firehose into triaged, actionable tickets — and cut the noise that buries the real ones.

<CardGroup cols={2}>
  <Card title="Security Alert Response" icon="shield-halved" href="/skill-library/security/security-alert-response">
    A consistent first-response path for any security alert.
  </Card>

  <Card title="EDR Detection Runbook" icon="laptop-code" href="/skill-library/security/edr-detection-runbook">
    Work an endpoint detection from alert to resolution.
  </Card>

  <Card title="DLP Alert Triage" icon="file-shield" href="/skill-library/security/dlp-alert-triage">
    Assess a data-loss alert and decide the response.
  </Card>

  <Card title="Security Noise Tuning" icon="volume-xmark" href="/skill-library/security/security-noise-tuning">
    Cut false positives so real alerts stand out.
  </Card>
</CardGroup>

## SOC operations

The rituals and briefs that keep a security desk coherent across shifts and clients.

<CardGroup cols={2}>
  <Card title="SOC Shift Handoff" icon="arrows-rotate" href="/skill-library/security/soc-shift-handoff">
    Hand off open incidents and watch items cleanly.
  </Card>

  <Card title="SOC Classification Tree" icon="sitemap" href="/skill-library/security/soc-classification-tree">
    Classify events consistently, every analyst the same way.
  </Card>

  <Card title="Security Incident Postmortem" icon="magnifying-glass-chart" href="/skill-library/security/security-incident-postmortem">
    Turn an incident into lessons and follow-up actions.
  </Card>

  <Card title="Monthly Security Report" icon="calendar-check" href="/skill-library/security/monthly-security-report">
    Make a month of security work visible to clients.
  </Card>
</CardGroup>

## Compliance and audit

The evidence, questionnaires, and framework prep that carry your posture through an assessment.

<CardGroup cols={2}>
  <Card title="Audit Prep Review" icon="clipboard-check" href="/skill-library/compliance-and-audit/audit-prep-review">
    Get ready for an audit without the last-minute scramble.
  </Card>

  <Card title="SOC 2 Evidence Collection" icon="folder-tree" href="/skill-library/compliance-and-audit/soc2-evidence-collection">
    Gather and organize evidence for a SOC 2 cycle.
  </Card>

  <Card title="Security Questionnaire & Vendor DDQ" icon="list-check" href="/skill-library/compliance-and-audit/security-questionnaire-vendor-ddq">
    Answer client security questionnaires and vendor due diligence.
  </Card>

  <Card title="HIPAA Safeguards Checklist" icon="staff-snake" href="/skill-library/compliance-and-audit/hipaa-safeguards-checklist">
    Walk the HIPAA safeguards for a covered client.
  </Card>

  <Card title="NIST CSF Gap Brief" icon="diagram-project" href="/skill-library/compliance-and-audit/nist-csf-gap-brief">
    Map a client against the CSF and surface the gaps.
  </Card>

  <Card title="Cyber Insurance Form Prep" icon="file-signature" href="/skill-library/compliance-and-audit/cyber-insurance-form-prep">
    Prep an accurate cyber-insurance application.
  </Card>
</CardGroup>

<Tip>
  Every skill is prompt-first — open Super Magic on the relevant ticket and it inherits that ticket's context, so a runbook starts already knowing the client, contact, and conversation. Investigation stays read-only; any response step still confirms before it runs.
</Tip>

<MarkComplete id="security-compliance-owner/security-runbooks" />

## Next

That's the bench. Head back to the hub for your starter kit and shift ritual, or browse the full library.

<CardGroup cols={2}>
  <Card title="Back to your course" icon="shield-halved" href="/start-here/roles/security-compliance-owner">
    Starter kit, SOC ritual, and the FAQ.
  </Card>

  <Card title="Browse the Skill Library" icon="book-open" href="/skill-library/overview">
    Hundreds of skills — search any threat or framework.
  </Card>
</CardGroup>


## Related topics

- [Security & Compliance Owner](/start-here/roles/security-compliance-owner.md)
- [How Thread handles your data](/start-here/roles/security-compliance-owner/data-and-compliance.md)
- [Impossible Travel Runbook](/skill-library/security/impossible-travel-runbook.md)