Standard work is a lean operations method for defining the best known way to perform a task, including the sequence of steps, timing, inputs, and expected output. The goal is not to freeze work forever, but to make it repeatable, measurable, and easy to improve when better methods are found.
In cyber security, standard work helps teams reduce human error and make controls consistent across people, shifts, and systems. It is used for repeatable activities such as patching, account provisioning, log review, incident triage, and approval of AI-generated output. Attackers often exploit gaps where a process is informal or varies by operator; standard work narrows those gaps by requiring the same checks, documentation, and escalation steps every time. Defenders also use it to support auditability, because a clear process makes it easier to prove what happened, who approved it, and whether security policy was followed.