CDC Annual Operating Calendar — Template
Recurring work dies in backlogs; schedule it. Distribute heavy items across quarters; tie each to a control in the controls register. Adjust months to your audit/budget cycle.
| Quarter | Recurring tasks, as examples to adapt |
|---|---|
| Q1 | Threat profile & landscape refresh at ID-5 · detection portfolio review vs profile · charter/mandate review kickoff · quarterly: classification sample check, tuning metrics review, detection validation batch |
| Q2 | IR plan tabletop incl. management at RS-7 · statutory reporting drill vs 24 h clock · restore test #1 at PR-7 · RFC 2350 + standard mailboxes review · maturity self-assessment |
| Q3 | Containment catalogue review & technical isolation test · supplier/MSSP service review vs checklist · skills matrix reviews for all staff · budget input from the gap backlog · security tool portfolio review per Running the CDC §5 |
| Q4 | Internal/external audit window · joint BCM/CDC exercise at RC-6 · restore test #2 and ransomware-scale exercise at A-tier · annual report to executive management · next-year training plan from ECSF gaps |
| Monthly | Management/ops report from the metrics catalogue · tuning review cadence check · advisories/intel digest to stakeholders |
| Weekly | Tuning review per Running the CDC §1 · detection status update to the team · triage SLA dashboard check |
Template from the Open CDC Framework, licensed CC BY 4.0.