🚨 A living operational plan for preparing for, responding to, and learning from security incidents. Customize every organization-specific field before relying on it during an incident.

🧭 How to use this incident response plan

🎯 Purpose

This Incident Response Plan (IRP) is a living, operational document used to prepare for, respond to, and learn from security incidents. It is designed to be completed and maintained on a per‑customer basis and referenced during active incidents.

✅ 1. Complete Phase 1 — Preparation

Phase 1 must be completed in full for each customer before this document is considered usable.

Phase 1 establishes:

• Incident Response Team roles and contact information
• Escalation and communication procedures
• Regulatory and compliance obligations
• Available security, monitoring, and forensic tools
• Backup and testing practices

Phase 1 defines who responds, how decisions are made, and what tools are available during an incident.
An incomplete Phase 1 will significantly slow response efforts.

🔎 2. Review Phase 2 — Detection & Analysis

For the first revision, Phase 2 should be reviewed and partially completed to ensure responder awareness.

At minimum, document:

• How security alerts are received
  • SIEM, EDR, email security, MSSP, ticketing systems, etc.
• Which tools are used for detection and investigation
• Where alerts appear during an incident

The objective is familiarity, not execution. Responders should understand how an incident is detected and validated before handling a live event.

🚨 Using this document during an incident

Once an incident is identified:

• Use Phase 2 to validate, classify, and assess impact
• Use Phase 3 to guide containment, eradication, and recovery
• Document actions, decisions, and timelines as the incident progresses

This IRP should be used as both a reference guide and a record of response activities.

🧾 After the incident

Following incident resolution:

• Complete Phase 4 – Post‑Incident Activity
• Document lessons learned and identified gaps
• Update this IRP as needed to reflect improvements

🔄 Maintenance expectations

This IRP should be reviewed and updated:

• After any major incident
• When tooling, personnel, or regulations change
• At least annually

This document should always reflect the current operational state of the customer’s environment.

🛡️ Phase 1: Preparation

Preparation is the foundation of an effective incident response process. It involves establishing policies, teams, and tools to ensure a rapid and coordinated response to security incidents.

ESTABLISH AN INCIDENT RESPONSE TEAM (IRT)

A well-defined response team ensures that incidents are handled efficiently, reducing confusion and delays during a crisis.

Identify and assign roles:

• Incident Commander:
• Forensic Analyst:
• Communications Lead:

Document team contact information and escalation procedures:

• Incident Commander
  • Phone:
  • Email:
• Forensic Analyst
  • Phone:
  • Email:
• Communications Lead
  • Phone:
  • Email:

Ensure legal, HR, and executive management are aware of their responsibilities:

• Main Point of Contact at Company
  • Phone:
  • Email:

DEVELOP AN INCIDENT RESPONSE PLAN (IRP)

A documented IRP provides a structured approach to incident response, ensuring consistency and compliance with security best practices.

Define policies, procedures, and response playbooks for different incident types:

• Ransomware Playbook Location:
• Phishing Playbook Location:
• Insider Threat Playbook Location:

Align the IRP with organizational security policies and regulatory requirements:

• Regulatory Agency Governing the Company:

Ensure stakeholders are trained and understand the plan:

• Last Date IRP was reviewed with Company’s Main Stakeholder:

DEFINE COMMUNICATION AND ESCALATION PROTOCOLS

Clear communication protocols prevent misinformation and ensure that the right stakeholders are informed at the right time.

Identify internal communication channels for incident response:

• How communication will occur during an incident:

Establish external notification protocols for regulatory compliance:

• Regulatory Agency
  • Name:
  • Point of Contact:

Define the escalation process for leadership and law enforcement involvement:

• Escalation Step 1:
• Escalation Step 2:
• Escalation Step 3:
• Escalation Step 4:
• Escalation Step 5:

INVENTORY & DEPLOY INVESTIGATION TOOLS

Having the right tools in place allows for efficient detection, analysis, and response to security threats.

Maintain a list of forensic and security tools:

• Company’s SIEM:
• Company’s IDS/IPS:
• Company’s EDR:
• Company’s Preferred Forensic Imaging Software:

Ensure security logs are centrally stored and accessible:

• Location of centrally stored logs:

Validate chain-of-custody compliance:

• Date forensic tools were last reviewed:

TEST AND UPDATE RESPONSE PLANS

Regular testing ensures the incident response plan remains relevant and effective.

Conduct regular testing:

• Date of last tabletop exercise:
• Date of last penetration test:
• Date of last audit:

Update response plans as needed:

• Date IRP was last updated:

Ensure backups are tested and securely stored:

• Last backup test date:
• Backup storage method:

🔎 Phase 2: Detection & Analysis

Detection and analysis focus on identifying security incidents, assessing severity, and determining appropriate response actions.

IDENTIFY AND LOG SUSPICIOUS ACTIVITY

Early detection helps mitigate potential damage.

• Monitor security logs and alerts for indicators of compromise (IoCs)
• Enable automated alerts for:
  • Abnormal network traffic
  • Failed login attempts
  • Data exfiltration
• Cross-reference alerts with threat intelligence feeds (MITRE ATT&CK, ISACs)

VALIDATE AND CLASSIFY THE INCIDENT

Accurate classification ensures proper resource allocation.

• Assess credibility of detected threats
• Categorize incidents by severity:
  • Low
  • Medium
  • High
  • Critical
• Determine incident type:
  • Adversarial activity
  • Insider threat
  • System failure

PERFORM INITIAL IMPACT ASSESSMENT

Understanding impact enables better prioritization.

• Identify affected assets (systems, data, applications)
• Evaluate scope of data exposure:
  • PII
  • Financial data
  • Intellectual property
• Assign preliminary risk score (impact vs. likelihood)

COLLECT & PRESERVE EVIDENCE

Proper evidence handling is critical for forensics and legal actions.

• Secure logs, network captures, and disk images
• Maintain chain of custody
• Label evidence with:
  • Timestamps
  • Sources
  • Handlers

🧯 Phase 3: Containment, Eradication & Recovery

This phase focuses on stopping spread, eliminating root cause, and restoring operations.

IMPLEMENT CONTAINMENT STRATEGIES

Containment prevents further damage.

• Short-term containment
  • Isolate affected systems
  • Block malicious IPs
• Long-term containment
  • Patch vulnerabilities
  • Implement access controls
• Ensure business-critical operations remain functional

ERADICATE THE THREAT

Complete eradication prevents reoccurrence.

• Remove malware and malicious code
• Disable unauthorized accounts
• Apply patches and updates
• Strengthen authentication:
  • Enforce MFA
  • Rotate credentials

RESTORE AFFECTED SYSTEMS

Restoration ensures safe resumption of operations.

• Validate backup integrity
• Reimage and rebuild systems if required
• Conduct security testing before returning systems to production

MONITOR FOR RESIDUAL THREATS

Ongoing monitoring ensures full remediation.

• Perform threat hunting
• Deploy network segmentation
• Review logs for signs of persistence

📈 Phase 4: Post-Incident Activity

Post-incident review enables continuous improvement.

CONDUCT A POST-INCIDENT REVIEW

A structured review identifies opportunities for improvement.

• Hold retrospective with Security, IT, Legal, and HR
• Identify gaps in detection, response, and recovery
• Document findings in a formal incident report

UPDATE SECURITY MEASURES

Continuous updates strengthen security posture.

• Implement new security controls
• Revise:
  • Security policies
  • Employee training
  • IR procedures
• Enhance monitoring capabilities

SHARE LESSONS LEARNED

Sharing insights improves awareness and resilience.

• Communicate findings internally
• Share sanitized reports with industry partners or ISACs (if applicable)
• Update incident response playbooks