Cyber Incident Response Plan Template

Standard Operating Procedure: Cyber Incident Response Plan (CIRP)

Document ID: TR-SEC-IRP-001
Effective Date: 2023-10-27
Version: 1.0.0
Review Cadence: Semi-Annual (or post-incident)

---

1. Executive Summary & Purpose

This document establishes the tactical framework for identifying, containing, eradicating, and recovering from cybersecurity incidents at Template Registry. The purpose is to minimize operational downtime, protect data integrity, and ensure regulatory compliance through a standardized, repeatable methodology.

2. Scope & Prerequisites

• Scope: All digital assets, cloud infrastructure, on-premise hardware, and personnel data managed by Template Registry.
• Required Tools:
  • SIEM (e.g., Splunk/ELK) for log correlation.
  • EDR (e.g., CrowdStrike/SentinelOne) for endpoint isolation.
  • Out-of-Band (OOB) Communication: Signal or dedicated Slack Incident channel.
  • Forensic Imaging toolkit.

3. Roles & Responsibilities (RACI)

---

4. Step-by-Step Procedure

Phase 1: Identification & Triage

• Verify incident trigger via SIEM alert or user report.
• Establish OOB communication channel.
• Determine incident severity (Critical, High, Medium, Low).
• Assign Incident Commander (IC).

Phase 2: Containment

• Implement short-term containment (e.g., network isolation, disabling compromised credentials).
• Capture volatile memory and forensic images before system restarts.
• Verify system backups for integrity.

Phase 3: Eradication

• Identify root cause (e.g., vulnerability, phishing, misconfiguration).
• Remove malicious artifacts, rootkits, or backdoors.
• Patch vulnerabilities associated with the attack vector.

Phase 4: Recovery

• Restore systems from "known good" backups.
• Implement heightened monitoring (24/7 observation) for 72 hours.
• Perform password resets for all affected entities.

Phase 5: Post-Incident Activity

• Conduct "Lessons Learned" briefing within 5 business days.
• Update CIRP documentation based on findings.
• Close ticket/log incident in the compliance registry.

---

5. Quality Assurance & Pro-Tips

• Metric Thresholds: Mean Time to Detect (MTTD) < 1 hour; Mean Time to Contain (MTTC) < 4 hours.
• Pro-Tip 1: Never trust the compromised environment for communication. If the network is breached, assume the internal email is monitored. Use the designated OOB channel.
• Pro-Tip 2: Document everything in a timestamped "Chronology Log." Documentation generated in real-time is vital for insurance claims and legal defense.
• Common Pitfall: Jumping to eradication before containment. Failure to isolate the threat often leads to re-infection via persistent lateral movement.

---

6. Frequently Asked Questions

Q: Should I reboot a compromised server immediately to stop the activity? A: No. Rebooting clears volatile RAM, destroying forensic evidence necessary for root cause analysis. Isolate the server via network ACLs or EDR commands instead.

Q: When is it appropriate to notify law enforcement or regulators? A: Consult with Legal immediately upon confirmed data exfiltration or if the incident meets GDPR/CCPA reporting thresholds. Do not wait for complete eradication before initiating legal assessment.

Q: What if the Incident Commander is unavailable? A: Establish a pre-designated "Alternate IC" in your personnel list. If both are unavailable, the most senior engineer on shift assumes the IC role by default.

---

Authorized by: Julian Vance, Chief Architect, Template Registry.