Security operations procedure

Status: proposed procedure links for LMA-PROC-006 through LMA-PROC-009. The existing security policy remains authoritative for reporting vulnerabilities.

Trigger	Responsible role	Procedure and required record
Vulnerability report	Security contact	Follow the security policy; retain restricted triage, remediation and disclosure records.
Dependency change	Dependency owner	Review applicability, update pins and run affected checks; retain the decision and results.
Service or access change	Maintainer	Follow service bootstrap; record authorization and continuity arrangements.
Incident or recovery exercise	Incident owner	Record containment, recovery, timeline and follow-up work under the applicable security policy.

Use the OpenSSF plan for criterion-specific obligations and the gap register for missing services or ownership. Keep private operational records in an authorized restricted store; public documentation may link to a sanitized summary.