CDC Annual Operating Calendar — Template¶
Recurring work dies in backlogs; schedule it. Distribute heavy items across quarters; tie each to a control (controls register). Adjust months to your audit/budget cycle.
| Quarter | Recurring tasks (examples — adapt) |
|---|---|
| Q1 | Threat profile & landscape refresh (ID-5) · detection portfolio review vs profile · charter/mandate review kickoff · quarterly: classification sample check, tuning metrics review, detection validation batch |
| Q2 | IR plan tabletop incl. management (RS-7) · statutory reporting drill vs 24 h clock · restore test #1 (PR-7) · RFC 2350 + standard mailboxes review · maturity self-assessment |
| Q3 | Containment catalogue review & technical isolation test · supplier/MSSP service review vs checklist · skills matrix reviews (all staff) · budget/roadmap input from gap backlog · security tool portfolio review (13-cdc-operations §5) |
| Q4 | Internal/external audit window · joint BCM/CDC exercise (RC-6) · restore test #2 / ransomware-scale exercise (A-tier) · annual report to executive management · next-year training plan from ECSF gaps |
| Monthly | Management/ops report (metrics catalogue) · tuning review cadence check · advisories/intel digest to stakeholders |
| Weekly | Tuning review (13-cdc-operations §1) · detection status update to the team · triage SLA dashboard check |
Template from the Open CDC Framework (CC BY 4.0).