Cyber Incident Response Plan Template NIST

Standard Operating Procedure: NIST-Compliant Cyber Incident Response Plan (CIRP) Deployment

1. Document Control Block

• Document ID: SOP-SEC-NIST-CIRP-042
• Effective Date: October 24, 2023
• Version: 3.1.0
• Review Cadence: Semi-Annual (Next Review: April 2024)
• Classification: Internal / Restricted - Template Registry Information Security

---

2. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional-grade framework for executing, maintaining, and operationalizing a Cyber Incident Response Plan (CIRP) aligned with the National Institute of Standards and Technology (NIST) Special Publication 800-61 Rev. 2 guidelines. The purpose of this document is to establish a repeatable, auditable, and high-velocity engineering workflow to contain, eradicate, and recover from information security incidents while preserving forensic integrity and minimizing business interruption across Template Registry infrastructure.

---

3. Scope & Prerequisites

3.1 Scope

This procedure applies to all production environments, corporate IT systems, cloud-hosted repositories, edge networks, and data assets owned, operated, or managed by Template Registry.

3.2 Prerequisites & Required Tooling

• Access Credentials: Privileged access management (PAM) vault access with break-glass administrative accounts.
• SIEM / Log Management: Datadog, Splunk Enterprise Security, or AWS CloudWatch / GuardDuty.
• Endpoint Detection & Response (EDR): CrowdStrike Falcon or Microsoft Defender for Endpoint.
• Forensic Capture Tools: Volatility Framework, FTK Imager, Wireshark, dd utilities.
• Secure Collaboration Channels: Out-of-band encrypted communication platform (e.g., Signal enterprise or dedicated war-room Slack channel with restricted access).
• Physical Prerequisites: Hardware write-blockers for physical media acquisition; isolated air-gapped forensic workstations.

---

4. Roles & Responsibilities

---

5. Step-by-Step Procedure

The lifecycle of incident response strictly follows the four core phases defined in NIST SP 800-61.

Phase 1: Preparation

• Ensure continuous logging, log aggregation, and retention policies are active across all infrastructure tiers.
• Verify that EDR, IDS/IPS, and vulnerability scanning agents are deployed and reporting healthy status to the security dashboard.
• Conduct bi-annual table-top exercises simulating targeted Advanced Persistent Threat (APT) vectors and ransomware campaigns.
• Maintain an updated, out-of-band contact roster for internal stakeholders, third-party retainers (forensic/legal), and law enforcement.

Phase 2: Detection & Analysis

• Triage Alert: Acknowledge security alerts within the SLA window (Critical: < 15 minutes, High: < 60 minutes).
• Validate Incident: Correlate telemetry across EDR, network flows, and authentication logs to rule out false positives.
• Determine Scope: Identify compromised assets, user accounts, data classifications impacted, and initial vector of entry.
• Classify Severity: Assign an incident tier (Severity 1: Catastrophic/Enterprise-wide; Severity 2: Major/Localized system compromise; Severity 3: Minor/Isolated anomaly).
• Open Incident Ticket: Instantly initialize an immutable incident record in the SIEM/ITSM system and spin up the secure war room.

Phase 3: Containment, Eradication, & Recovery

• Execute Containment Strategy:
  • Isolate compromised hosts from the network via EDR isolation or virtual security group/firewall rule application.
  • Revoke active sessions, rotate compromised IAM credentials, and enforce multi-factor authentication (MFA) step-up.
• Preserve Evidence:
  • Capture volatile memory (RAM) and running processes prior to host reboot or power-down.
  • Generate bit-stream disk images (dd or specialized forensic toolsets) of impacted storage volumes, ensuring cryptographic hashes (SHA-256) are calculated and logged for chain of custody.
• Eradicate Threat:
  • Remove identified malware binaries, unauthorized scheduled tasks, persistence mechanisms, and backdoors.
  • Patch underlying vulnerabilities or misconfigurations that permitted the initial exploitation.
• Execute Recovery:
  • Restore systems from known-good, immutable backups verified to be free of malware artifacts.
  • Re-introduce systems to the production network under heightened monitoring (Enhanced Logging Mode).
  • Validate system integrity, service availability, and functional dependencies.

Phase 4: Post-Incident Activity ("Lessons Learned")

• Conduct Post-Mortem: Convene an incident review meeting with all core responders within 5 business days of incident closure.
• Compile Root Cause Analysis (RCA): Document the timeline of events, attack vector, operational impact, and response efficacy.
• Update Controls: Implement corrective and preventive actions (CAPA) into the infrastructure roadmap, updating detection rules, playbooks, and hardening standards.
• Finalize Documentation: Archive all forensic artifacts, tickets, and the final RCA report in the secure compliance repository.

---

6. Quality Assurance & Pro-Tips

6.1 Best Practices

• Chain of Custody: Treat every compromised machine as potential evidence for criminal prosecution. Maintain strict logs of who accessed forensic artifacts and when.
• Communication Discipline: Never communicate operational details of an ongoing incident over unencrypted corporate email or standard messaging apps. Use designated out-of-band channels.

6.2 Common Pitfalls

• Premature Remediation: Wiping or rebooting a compromised system before capturing volatile memory destroys crucial forensic evidence (e.g., active network connections, injected shellcode).
• Siloed Response: Failing to involve legal counsel and public relations early can lead to regulatory reporting violations or brand reputation damage.

6.3 Metric Thresholds

• Mean Time to Detect (MTTD): < 15 minutes for Critical anomalies.
• Mean Time to Respond/Contain (MTTR): < 45 minutes from alert validation to host isolation.
• Post-Mortem Execution: Completed within 120 hours of incident resolution.

---

7. Frequently Asked Questions (FAQ)

Q1: What is the absolute first action to take when ransomware is detected on a production database server?
A: Immediately isolate the host from the network using the EDR containment feature to prevent lateral movement, but do not power off or reboot the server, as this destroys volatile memory required for forensic analysis. Notify the Incident Response Commander immediately.

Q2: When must regulatory bodies or customers be notified of a data breach under this SOP?
A: The determination of external notification is strictly the responsibility of Legal Counsel and Executive Leadership. The engineering team's sole responsibility is providing an accurate forensic scope and timeline. Never make independent external statements or disclosures regarding an incident.