Incident Response Playbook

INCIDENT RESPONSE

Incident Response Process

INCIDENT RESPONSE PHASES

1. DETECTION
☐ Alert received
☐ Initial triage
☐ Severity determined
☐ Response team notified

2. ANALYSIS
☐ Scope determined
☐ Impact assessed
☐ Root cause identified
☐ Evidence preserved

3. CONTAINMENT
☐ Immediate actions taken
☐ Spread prevented
☐ Systems isolated (if needed)
☐ Business impact minimized

4. ERADICATION
☐ Threat removed
☐ Vulnerabilities patched
☐ Credentials reset (if needed)
☐ Systems hardened

5. RECOVERY
☐ Systems restored
☐ Normal operations resumed
☐ Monitoring enhanced
☐ Stakeholders notified

6. POST-INCIDENT
☐ Timeline documented
☐ Lessons learned captured
☐ Process improvements identified
☐ Report completed

Incident Severity Classification

Severity	Definition	Response Time
Critical	Business-stopping, data breach	Immediate
High	Major impact, service disruption	<1 hour
Medium	Limited impact, contained	<4 hours
Low	Minimal impact, no breach	<24 hours

Incident Response Contacts

INCIDENT RESPONSE TEAM

INCIDENT COMMANDER:
Primary: _______________
Backup: _______________

TECHNICAL LEAD:
Primary: _______________
Backup: _______________

COMMUNICATIONS:
Primary: _______________
Backup: _______________

EXTERNAL RESOURCES:
Legal: _______________
PR: _______________
Forensics: _______________

Incident Report Template

INCIDENT REPORT

INCIDENT #: _______________
Date detected: _______________
Date resolved: _______________
Severity: ☐ Critical ☐ High ☐ Medium ☐ Low

SUMMARY:
[What happened]

TIMELINE:
[Key events with timestamps]

IMPACT:
Systems affected: _______________
Data affected: ☐ Yes ☐ No
Customers affected: ☐ Yes ☐ No

ROOT CAUSE:
_______________

REMEDIATION:
_______________

LESSONS LEARNED:
_______________

---