Coordination as a Security Control: Evidence from Alert Adjudication Records

Security monitoring is commonly treated as a detection problem, yet in certified information security management systems it operates as a socio-technical control whose effectiveness depends on people who adjudicate the alerts it produces. This study asks where the information that adjudication depends on resides, and what contemporaneous adjudication records offer as evidence that the control operated. It analyses the complete adjudication record of a public-sector security function over seventeen months: 423 alerts, each closed by one administrator who recorded the basis of the determination, matched against an independently timestamped coordination channel. Half the alerts were closed on documented information the deployed monitoring did not ingest, chiefly maintenance announcements; for restart-related alerts, announcement coverage was 91.5 per cent. Nearly half required verification with a responsible party, drawing on identifier records and operational knowledge. An independent coder reproduced the coding with substantial agreement. We interpret the findings as an information–integration gap in the observed deployment rather than a limit of detection: the information on which these alerts were closed was not among the detector’s inputs. Coordination between system owners and the security function operates as a control whose coverage can be measured, and adjudication records make its operation traceable to assessors.