LSSCO Secure OperationsMeridian House / Sample control record
Executive position
Core ownership is visible, but a former controls-vendor account remains open, CCTV backup evidence is incomplete and the incident isolation route has not been formally accepted by the owner.
| Control area | Position | Next action |
|---|---|---|
| Door access administrator | Named | Confirm deputy and annual review |
| CCTV configuration backup | Partial | Obtain provider-supplied restoration evidence |
| Former controls vendor | Expired | Remove access and retain confirmation |
| Incident isolation authority | Draft | Owner acceptance required |
Operating boundary
This sample records what management needs to know. It does not scan the network, detect an intrusion, revoke an account or validate a backup.
- Technical provider supplies system evidence.
- LSSCO records ownership, status, exceptions and decisions.
- The owner accepts risk, funding and operating priorities.
- Safety-critical testing remains separately authorized.
Connected asset register
Filter the synthetic register by management status. “Evidence source” states where the technical position would need to come from.
| Asset | Business owner | Technical provider | Evidence source | Status |
|---|---|---|---|---|
| Door access controller | Facilities lead | Access integrator | Integrator export and handover record | Controlled |
| CCTV recorder | Property manager | Security installer | Provider backup and restoration evidence | Gap |
| BMS gateway | Facilities lead | Controls contractor | Provider access list and service report | Review |
| Guest Wi-Fi | IT owner | Managed IT provider | Configuration record supplied by provider | Controlled |
| Energy dashboard | Asset manager | Metering vendor | Vendor account report | Review |
| Visitor management tablet | Front-of-house lead | Application provider | Owner-approved account register | Controlled |
Vendor-access position
| Vendor | Purpose | Sponsor | Review date | Position |
|---|---|---|---|---|
| Access integrator | Scheduled door maintenance | Facilities lead | 30 Sep 2026 | Active |
| Former BMS contractor | Historic commissioning | No current sponsor | Expired | Remove |
| CCTV installer | Support and backup evidence | Property manager | 15 Aug 2026 | Review |
Required offboarding evidence
- Owner instruction identifying the account or access route.
- Provider confirmation that access was removed or disabled.
- Review of any shared credentials or retained service accounts.
- Decision on configuration files, documentation and support records.
- Update to the vendor and connected-asset registers.
Safe tabletop exercise
Scenario: activity is reported against a former controls-vendor account after handover. The exercise tests management ownership only; it does not connect to or test a live system.
Decision route
- Business owner confirms incident lead and authority.
- Appointed technical provider validates the event and contains access.
- Facilities lead protects operational continuity and safety constraints.
- Records and communications are preserved through the agreed route.
- Restoration is verified by the competent provider.
- Owner accepts residual risk and corrective actions.
Recovery evidence
| System | Recovery requirement | Evidence owner | Current evidence | Position |
|---|---|---|---|---|
| Door access | Administrator transfer and configuration restore route | Access integrator | Handover export referenced | Recorded |
| CCTV | Recorder configuration and restoration test | Security installer | Backup mentioned; test not evidenced | Incomplete |
| BMS gateway | Known-good configuration and provider contact | Controls contractor | Service report only | Partial |
| Guest Wi-Fi | Configuration and credential recovery process | IT provider | Provider record referenced | Recorded |
“Recorded” means that evidence is referenced in the management record. It does not mean LSSCO independently tested the recovery process.
Owner transfer checklist
Browser-local behavior
Checklist state is saved only in the current browser through local storage. It is not synchronized, submitted or treated as a client record.
Owner transfer pack
- System context and connected-asset register
- Access and vendor matrix
- Risk and corrective-action record
- Incident contacts and decision route
- Recovery evidence references
- Open items and owner acceptance