Bedrock CybersecuritySecurity & Infrastructure Docs

One source of truth for Cirius Group — architecture, runbooks, and compliance, continuously verified against the live environment.

Browse Runbooks

SOC Platform →

Operations & Status

🚨

Incident Response

Step-by-step runbooks for ransomware, breaches, and outages. Arctic Wolf escalation paths. Break-glass procedure for 18 accounts.

Open runbook

🔒

Kill Chain Detection

Detection agents across all 8 kill chain stages. Incident triage on the SOC platform at soc.bedrockcybersecurity.org.

Kill chain spec

☁️

Azure Infrastructure

PROD (ciriusgroup.com) + DDE (ciriusdde.com). Hub-spoke networking, Palo Alto NVAs, Arctic Wolf MDR, Intune device management.

Architecture

🌐

AWS Disaster Recovery

7-account org with Transit Gateway hub-spoke. Palo Alto firewalls, Veeam replication targets. DR failover tested Q2 2026.

DR overview

📋

Compliance — HITRUST Sep 2026

HIPAA controls matrix, SOC2 PBC guide, formal risk assessment §164.308, vendor PHI inventory, IR tabletops, DR test plans.

HIPAA controls

📖

Runbooks (117)

Backup & restore, Intune, Arctic Wolf, Azure daily ops, AWS Audit Manager, certificate renewal, kill chain response playbooks.

All runbooks

Quick reference by role

Jump straight to what you need. Live system status, current priorities, and the CI/CD pipeline reference live on the Operations & Status page.

🔴 On-call / Security Engineering

Link	Description
Incident Response	Ransomware, breaches, outages — start here
Alert Triage	Sources, routing, severity, escalation
Break-Glass Procedure	Emergency access for 18 accounts
Monthly Threat Hunt	KQL patterns and evidence retention
Out-of-Band Comms	When primary channels are compromised
Kill Chain Coverage	Detection status per stage

📋 Compliance

Link	Description
Compliance Scorecard	Current posture — update weekly
HIPAA Controls	Full controls matrix
SOC2 PBC Guide	Auditor request mapping
Risk Assessment	§164.308 formal assessment
Vendor PHI Inventory	BAA status for all PHI vendors
Training Log	KnowBe4, HIPAA, tabletop

🛠️ Infrastructure / Daily Ops

Link	Description
Azure Daily Operations	Routine Azure tasks
AWS Account Access	SSO, IAM Identity Center
Common Tasks	Server, firewall, cert operations
Twingate Operations	User/resource/connector management
Arctic Wolf Day-to-Day	MDR daily operations
Backup Architecture	RSV, Veeam, offline backups

🔧 Security Architecture

Link	Description
Threat Model	Canonical — crown jewels, threat actors, STRIDE
Palo Alto Overview	4 × VM-Series, Panorama, DNS Security
Patch Management	Cadence, approval, emergency patch
Deception Layer	Canary tokens + honeypots
SecOps API Reference	Endpoints, incident lifecycle, known-good rules
Key Learnings	Hard-won gotchas — read before troubleshooting

</div>