Acsc Cyber Incident Response Plan Template

Standard Operating Procedure: Cyber Incident Response Plan (CIRP)

Template Registry | Engineering Division

---

1. Document Control Block

---

2. Executive Summary & Purpose

This document provides the standardized framework for the detection, containment, eradication, and recovery phases following a cybersecurity event. It aligns with the ACSC Strategies to Mitigate Cyber Security Incidents to ensure organizational resilience, data integrity, and compliance with mandatory reporting obligations.

---

3. Scope & Prerequisites

• Scope: All information systems, cloud infrastructure, and endpoint assets managed by Template Registry.
• Required Tools: SIEM/SOAR platform, immutable backup repository, offline communication channel (e.g., Signal or encrypted messaging), forensic imaging toolkit.
• PPE: N/A (Digital focus).

---

4. Roles & Responsibilities (RACI)

---

5. Step-by-Step Procedure

Phase 1: Detection and Analysis

• Verify the anomaly against SIEM baselines.
• Establish "War Room" (out-of-band communication).
• Define Incident Severity (Low, Medium, High, Critical).
• Preserve volatile data (RAM dumps, process lists) prior to system state changes.

Phase 2: Containment

• Segment affected network segments to isolate the blast radius.
• Revoke compromised credentials and rotate privileged access keys.
• Deploy block-rules on firewalls/EDR to prevent lateral movement.
• Verify integrity of immutable backups.

Phase 3: Eradication and Recovery

• Conduct root cause analysis (RCA) to identify the initial entry vector.
• Wipe, rebuild, or patch compromised assets from verified "gold images."
• Perform vulnerability scanning on restored systems.
• Gradually restore services, monitoring for re-infection signatures.

Phase 4: Post-Incident Activity

• Conduct "Lessons Learned" meeting within 72 hours of closure.
• Update incident documentation and historical logs.
• Submit mandatory reports to the ACSC if reportable data breach thresholds are met.

---

6. Quality Assurance & Pro-Tips

• Pro-Tip 1: Never perform analysis on the primary production environment; move artifacts to an isolated sandbox.
• Pro-Tip 2: Maintain "Break Glass" accounts that exist outside of your primary Active Directory/IAM provider.
• Metric Thresholds: Mean Time to Detect (MTTD) < 2 hours; Mean Time to Contain (MTTC) < 4 hours.
• Common Pitfall: Failing to document time-stamped actions leads to legal friction during forensic auditing.

---

7. Frequently Asked Questions

Q: At what stage should we contact external authorities? A: If the incident involves PII, financial theft, or infrastructure critical to the ACSC criteria, legal counsel should be notified immediately during the Detection phase to manage reporting windows.

Q: Should we shut down the server if we suspect an intrusion? A: No. Pulling the plug destroys volatile memory evidence. Perform a controlled isolation (vLAN shift) instead to keep services running for forensic memory capture.

Q: How do we handle "False Positives" during active incidents? A: Rely on cross-correlation between logs (e.g., EDR + Firewall + VPN). If three disparate sources corroborate the anomaly, treat as a "True Positive" until proven otherwise.

---

Authorized by: Julian Vance, Chief Architect, Template Registry