Acsc Incident Response Plan Template

Standard Operating Procedure: Incident Response Plan (ACSC Aligned)

Document ID: TR-SEC-IRP-001
Effective Date: 2023-10-27
Version: 2.1.0
Review Cadence: Semi-Annual (or post-incident)

---

1. Executive Summary & Purpose

This document establishes the institutional framework for detecting, analyzing, containing, and recovering from cybersecurity incidents. It is architected to align with the Australian Cyber Security Centre (ACSC) Strategies to Mitigate Cyber Security Incidents and the Essential Eight framework. The objective is to minimize operational impact and ensure forensic integrity during active threats.

2. Scope & Prerequisites

• Scope: All digital assets, cloud infrastructure, endpoints, and data repositories owned or managed by Template Registry.
• Tools Required: SIEM/SOAR platform, EDR (Endpoint Detection & Response), Immutable Log Storage, Out-of-Band (OOB) communication channels (e.g., Signal or dedicated Slack workspace).
• Software Prerequisites: Access to VPN/MFA bypass protocols, forensic imaging tools (FTK/EnCase), and cloud snapshot utilities.

3. Roles & Responsibilities (RACI)

---

4. Step-by-Step Procedure

Phase I: Detection & Analysis

• Verify alert trigger via SIEM telemetry.
• Define the scope of impact (Assets affected, data classification).
• Determine incident severity (Low, Medium, High, Critical) per business impact matrix.
• Document initial findings in the Immutable Incident Log.

Phase II: Containment

• Short-term: Isolate affected hosts from the internal network.
• Short-term: Revoke compromised credentials/API keys.
• Long-term: Apply firewall blocks or segmentation rules.
• Capture forensic artifacts (Memory dumps, disk images, network pcap) prior to system reboot/wiping.

Phase III: Eradication

• Identify root cause (e.g., phishing, zero-day, misconfiguration).
• Remove malicious code, backdoors, and persistence mechanisms.
• Conduct full anti-malware and vulnerability scans on related systems.

Phase IV: Recovery

• Restore services from the last known-good backup.
• Verify system integrity and harden configurations (ACSC baseline).
• Monitor logs for 72 hours for signs of re-infection or lateral movement.

Phase V: Lessons Learned (Post-Incident)

• Conduct formal "Blame-Free Post-Mortem" within 5 business days.
• Update documentation and IRP based on identified gaps.
• Update IOC (Indicator of Compromise) library.

---

5. Quality Assurance & Pro-Tips

• Metric Thresholds: Mean Time to Detect (MTTD) < 2 hours; Mean Time to Contain (MTTC) < 4 hours.
• The "Out-of-Band" Rule: Never use your company email or messaging tools for incident communication if you suspect the environment is compromised. Use OOB channels.
• Forensic Integrity: Always calculate and record SHA-256 hashes for all forensic images captured. Chain of custody is non-negotiable.
• Common Pitfall: Rushing to restore systems before finding the root cause. This leads to cyclic infection loops.

---

6. Frequently Asked Questions

Q: At what point do we report to the ACSC?
A: For "Critical" incidents, reporting is mandatory per the Security of Critical Infrastructure (SOCI) Act or relevant contractual obligations. If in doubt, notify the legal department immediately for regulatory assessment.

Q: Should we shut down systems immediately upon alert?
A: No. Immediate shutdown risks destroying volatile memory (RAM) artifacts needed for forensic analysis. Follow the Containment phase to isolate at the network level first unless data exfiltration is confirmed in progress.

Q: How do I handle internal pressure during an outage?
A: The Incident Commander is the sole point of contact for stakeholders. Technical staff must focus solely on remediation and forensic accuracy. Maintain a rigid "Communication Shield" to prevent distractions.

---

End of Document. Authored by Julian Vance, Chief Architect.