Pillar 6: Automation & Orchestration
Automate manual security processes to take policy-based, risk-informed actions across the enterprise with speed and at scale.
Key principles
- Policy decisions are centralized (a Policy Decision Point) and enforced consistently everywhere (Policy Enforcement Points).
- Response to detected risk is automated wherever confidence allows, freeing analysts for judgment calls.
- Orchestration ties signals from every other pillar into a single enforcement fabric.
Maturity snapshot
| Stage | Characteristics |
|---|---|
| Traditional | Manual incident response runbooks, policy enforced locally per system |
| Advanced | Automated SOAR playbooks for common alerts; centralized PDP/PEP for major application tiers |
| Optimal | Self-healing, policy-driven response integrated across all pillars; unified PDP evaluating real-time cross-pillar risk |
Related capabilities
See SOAR and Centralized Policy Decision Point in the capability matrix.
Framework tie-ins
NIST 800-53 (IR family), NIST 800-207 §3.2 (PDP/PEP model), NYDFS 500 (500.16).
Capabilities in this pillar
Change Management / Policy-as-Code Governance
Manual change tickets; ad hoc approval
Automated CI/CD-gated change approval with policy checks
Fully automated, auditable change pipeline with real-time compliance validation
Security Orchestration, Automation & Response (SOAR)
Manual incident response runbooks
Automated playbooks for common alert types
Policy-driven, self-healing response integrated across all pillars
Centralized Policy Decision Point (PDP)
Policy enforced locally per system, no central authority
Centralized PDP/PEP model for major application tiers
Unified PDP evaluating real-time risk signals across all pillars for every access request
Regulatory Reporting Automation
Manual compilation of compliance evidence
Semi-automated evidence collection for audits
Continuous, automated compliance reporting and regulator-ready evidence packages