Incident Response

An incident response plan is an organization’s predetermined plan for addressing a cyberattack. An incident response plan should include a list of incident response team members with roles and responsibilities as well as tools and technologies, steps to detect and identify cyberattacks, steps to contain and minimize damage (including reputational damage) and processes for incident recovery.

How to Create an Incident Response Plan

The six steps of an incident response plan, according to the SANS Institute checklist, are:

1. Preparation: Train users and security staff to manage potential security incidents.
2. Identification: Determine whether an event qualifies as a security incident.
3. Containment: Limit the damage of a cybersecurity incident and isolate affected systems to prevent more damage.
4. Eradication: Find the root cause of the incident and remove affected systems from the production environment.
5. Recovery: Ensure no threat remains and permit affected systems back into the production environment.
6. Lessons learned: Document the incident, perform analysis to learn from the incident and update procedures to improve future incident response.