update

Author: aring87

docs/04_reporting/TRACKING_PACK_README.md

@@ -1,3 +1,209 @@
-# Annual Roadmap Review
+# Annual Detection Engineering Roadmap Review
 
-Review strategic progress, remaining gaps, and next-year objectives.
+## Purpose
+
+This document provides a structured annual review of the detection engineering roadmap, program progress, major accomplishments, remaining gaps, and strategic priorities for the next planning cycle.
+
+The goal is to evaluate how effectively the program progressed against its roadmap and to identify where focus, investment, or structural changes are needed next.
+
+---
+
+## Review Period
+
+**Year:**  
+**Prepared By:**  
+**Review Date:**  
+
+---
+
+## Executive Summary
+
+Provide a concise summary of the year’s detection engineering progress.
+
+Suggested topics:
+- major milestones completed
+- program structure improvements
+- detection content growth
+- governance and reporting maturity
+- major constraints or risks
+- strategic priorities for next year
+
+---
+
+## Roadmap Status Overview
+
+Summarize progress against each roadmap phase or objective.
+
+Example format:
+- Phase 1 — Foundation: complete
+- Phase 2 — Content Standardization: in progress
+- Phase 3 — Validation Framework: partially started
+- Phase 4 — Coverage Expansion: in progress
+- Phase 5 — Workflow Maturity: planned
+- Phase 6 — Automation and CI/CD: planned
+- Phase 7 — Reporting and Maturity Management: in progress
+- Phase 8 — Multi-Platform Expansion: future
+
+---
+
+## Major Accomplishments
+
+List key achievements during the year.
+
+Examples:
+- repository structure established
+- executive proposal completed
+- program charter and strategy documents added
+- governance documents created
+- starter detections developed across ATT&CK tactics
+- tracking matrix implemented
+- triage guides introduced
+- reporting templates built
+- visuals created for strategy and reporting use
+
+---
+
+## Detection Content Progress
+
+Summarize the state of detection content.
+
+Suggested areas:
+- total detections in repository
+- detections added this year
+- detections updated this year
+- detections by lifecycle
+- detections by tactic
+- normalization or schema consistency progress
+- triage guide coverage progress
+
+---
+
+## Governance and Documentation Progress
+
+Summarize maturity in:
+- mission, scope, and operating model
+- lifecycle management
+- change control
+- exception management
+- data source catalog
+- metrics catalog
+- reporting readiness
+- contribution model clarity
+
+---
+
+## Coverage Progress
+
+Describe progress in:
+- ATT&CK coverage expansion
+- identification of major gaps
+- tactic areas strengthened
+- telemetry-supported use case growth
+- remaining coverage weak points
+
+Optional supporting artifacts:
+- coverage matrix
+- visuals
+- tracking summaries
+- gap analysis
+
+---
+
+## Risks and Constraints
+
+Document major program challenges.
+
+Examples:
+- incomplete telemetry coverage
+- uneven metadata quality
+- limited validation maturity
+- insufficient ownership assignment
+- competing priorities
+- backlog growth
+- lack of automation support
+- cross-platform expansion not yet started
+
+---
+
+## Maturity Assessment
+
+Summarize the program’s current maturity using the detection engineering maturity model.
+
+Suggested areas to comment on:
+- strategy maturity
+- governance maturity
+- content maturity
+- operational readiness
+- reporting maturity
+- automation readiness
+
+Example:
+- current assessed maturity level
+- major traits supporting that level
+- major gaps preventing the next level
+
+---
+
+## Lessons Learned
+
+Capture the most important lessons from the year.
+
+Examples:
+- what helped accelerate progress
+- what slowed program maturity
+- where structure mattered most
+- where documentation prevented confusion
+- where future workflow improvements are needed
+
+---
+
+## Priority Objectives for Next Year
+
+List the most important goals for the next annual period.
+
+Examples:
+- finish content standardization
+- improve lifecycle discipline
+- expand validation structure
+- strengthen ATT&CK gap closure planning
+- improve metrics reporting cadence
+- introduce GitHub Actions quality checks
+- begin Splunk-aligned expansion
+
+---
+
+## Leadership Support Needed
+
+Document decisions or support needed from leadership or stakeholders.
+
+Examples:
+- telemetry onboarding support
+- program prioritization
+- staffing or ownership clarity
+- tooling support
+- validation environment needs
+- automation support
+
+---
+
+## Recommended Next-Year Focus Areas
+
+Suggested categories:
+- strategic maturity
+- reporting maturity
+- content quality
+- validation readiness
+- roadmap execution
+- cross-platform planning
+
+---
+
+## Appendix
+
+Optional supporting materials:
+- metrics summary
+- coverage matrix snapshot
+- visuals
+- quarterly review highlights
+- backlog summary
+- documentation completion summary