Demo ShieldWorks: cybersecurity operations day

Demo ShieldWorks is a managed security service provider with security operations centres in Dubai and London. It monitors 640 customer environments, sells annual monitoring and incident-response retainers, deploys analysts and tools, handles severity-based incidents, and reports evidence for ISO and customer audits. OSERP connects customer contracts, protected assets, licences, alerts, incidents, service hours, purchase orders, recurring invoices, credits, and financial close.

1. Onboard customers and protected assets

The customer profile records legal entity, tax registration, industry, data residency, security tier, contacts, escalation tree, billing currency, credit limit, and consent. An asset record stores customer, hostname or serial, environment, cloud account, owner, criticality, data classification, location, agent version, and monitoring status.

Field	Demo value	Impact
Customer	Demo Gulf Logistics LLC	Contract and tenant scope
Security tier	24×7 SOC Premium	SLA and pricing
Asset	WMS-PROD-01	Monitoring identity
Criticality	Tier 1	Response priority
Data class	Confidential	Access and evidence
Billing currency	USD	Invoice and receipt
Response SLA	P1 30 minutes	Work queue and credit
Residency	UAE	Data and service control

Duplicate asset identifiers are blocked within a customer. A retired asset keeps alert and incident history but cannot consume new monitoring entitlement.

2. Create contracts and recurring billing

The service contract header records customer, legal entity, security tier, start/end dates, renewal, currency, payment terms, SLA, data residency, incident-retainer hours, tax, price-list version, and approval. Lines record asset count, log volume, analyst hours, tools, onboarding, after-hours rate, and service credits.

Demo Gulf Logistics subscribes to 120 monitored assets at USD 165 each per month and a 40-hour annual incident retainer for USD 18,000. The initial invoice shows monthly recurring service, onboarding, tax, and prepaid retainer separately. Deferred revenue or contract liability follows the configured recognition rule; an unused retainer is not treated as earned service.

An amendment onboards 30 additional assets from 15 October. OSERP calculates the prorated charge, preserves the old schedule, and requires approval if the customer’s data residency changes.

3. Ingest alerts and manage incidents

Alert records store customer, asset, source, event time, detection rule, severity, hash, analyst, status, and correlation ID. Incident headers record incident number, severity, customer, affected assets, commander, opened time, SLA clock, containment, notification, root cause, evidence, and status. Timeline entries are immutable and include actor, timestamp, action, and evidence link.

A P1 ransomware alert starts the 30-minute SLA clock. The incident work order records triage, containment, eradication, recovery, customer updates, and post-incident review. Duplicate alerts correlate to the same incident by fingerprint; they do not inflate incident count or retainer usage.

4. Track analyst time and retainer consumption

Time entries store analyst, incident, task, start/end, billable flag, rate, currency, approval, and evidence. Retainer usage records contract, period, opening hours, consumed hours, included hours, overage, and balance. A 12-hour P1 response consumes retainer hours according to the contract rule; overtime requires manager approval.

Expense claims record incident, analyst, travel, vendor, currency, receipt, tax, and customer-billable decision. An advance remains open until expense evidence and bank settlement reconcile.

5. Manage tools, licences, and suppliers

Tool licences store vendor, product, tenant, seats, log volume, start/end dates, currency, renewal, data-processing agreement, and cost centre. Purchase orders record supplier, security review, service period, tax, currency, budget, and approval. Supplier invoices match contract, licence usage, and acceptance.

An expired endpoint licence creates a compliance exception and blocks new deployment. A usage overage is approved, linked to log-volume evidence, and allocated to customer or shared SOC cost according to policy.

6. Vulnerability and remediation work

Vulnerability records contain asset, CVE, severity, source, detected date, exploit status, owner, remediation deadline, exception, and evidence. Remediation work orders record patch, change reference, downtime, tester, result, rollback, and customer acceptance. A risk exception stores business justification, compensating control, expiry, approver, and review date.

SLA breach credits reference incident, clock, cause, contract rule, amount, tax, approver, and credit note. A false-positive closure requires analyst reason and correlation evidence.

7. Compliance evidence and multi-currency close

Compliance packs store framework, control, owner, test period, evidence, hash, reviewer, finding, corrective action, and due date. Customer reports can be generated from incident, asset, vulnerability, and access histories without exporting uncontrolled copies.

The group reports in USD while a London supplier bills GBP and some customers pay AED. Each invoice, receipt, licence bill, time entry, and credit stores transaction rate, source, timestamp, realised FX, and revaluation status. Close reconciles assets to entitlements, alerts to incidents, incidents to retainer hours, schedules to invoices, receipts to bank, tools to licences, vulnerabilities to evidence, SLA credits, tax, FX, and GL.

KPI	Before OSERP discipline	After OSERP discipline	Improvement
P1 response within SLA	82%	97%	+15 points
Retainer billing accuracy	91.5%	99.6%	+8.1 points
Vulnerability closure within target	68%	91%	+23 points
Audit evidence retrieval	9 days	2 days	78% faster
Monthly service close	11 days	3 days	73% faster

Practice challenge

Create a security-tier contract, onboard protected assets, ingest a duplicate alert, open a P1 incident, track containment time, consume retainer hours, raise a remediation work order, approve a tool licence, issue an SLA credit, produce a compliance evidence pack, settle a GBP supplier bill, revalue balances, and close the month. Explain every field, SLA clock, permission, formula, journal, tax result, API identifier, exception, and audit event.

Related: Project and WBS field guide, AR Invoice field guide, Expense Claim field guide, Workflow and Approval field guide, and API cookbook.