cyber incident response plan templates

Enterprise Cyber Incident Response Framework

Document Control

• Document ID: [__________]
• Version: [__________]
• Effective Date: [__________]
• Review Cycle: [Annual/Bi-Annual]

1. Purpose & Scope

This document provides the structural framework for detecting, containing, and recovering from information security threats at [Company Name]. This policy applies to all employees, contractors, and third-party vendors with access to [Company Name] information systems.

2. Prerequisites

• Centralized Logging: Access to [SIEM/Log Management Tool].
• Communication: Verified access to the out-of-band communication channel: [Slack/Signal/Teams Channel Name].
• Documentation: Access to the Incident Log Repository at [URL/Path].
• Authority: Pre-authorized signatures for emergency budget allocation.

3. Roles & Responsibilities (RACI)

4. Step-by-Step Procedure

Phase 1: Identification & Triage

• Record initial indicators of compromise (IoCs) in [Incident ID Log].
• Determine incident severity level (Low/Medium/High/Critical) based on [Impact Matrix].
• Notify the Incident Response Team via [Primary Alerting System].

Phase 2: Containment

• Isolate affected systems from the network segment [Network Segment ID].
• Disable compromised user credentials: [List of Affected Accounts].
• Capture volatile memory (RAM) and system images for forensic analysis.

Phase 3: Eradication

• Identify root cause: [Malware/Phishing/Insider/System Vulnerability].
• Remove malicious artifacts and patch identified vulnerabilities.
• Initiate password resets for all affected entities.

Phase 4: Recovery

• Restore services from clean backups dated [Date of Last Known Good Backup].
• Monitor systems for abnormal traffic patterns for [Number] hours.
• Validate system integrity against [Baseline Configuration Standard].

Phase 5: Lessons Learned

• Conduct a post-incident review meeting within [Number] business days.
• Document procedural failures and update the [Internal Knowledge Base].
• Close the incident ticket in [Ticketing System].

5. Quality Assurance, Pro-Tips, & Pitfalls

• QA: Perform a quarterly tabletop exercise to validate the contact list and technical access.
• Pro-Tip: Always maintain a physical "break-glass" copy of this plan in a secure, offline location.
• Common Pitfall: Failing to document steps in real-time. If it isn't written down, it didn't happen for forensic purposes.
• Pitfall: Over-communicating to internal staff before the situation is contained, leading to panic.

6. FAQs

Q: Who has the authority to declare a "Critical" incident? A: The [Incident Commander] or the [Chief Information Security Officer] has sole authority to trigger the Critical Incident protocol.

Q: How do we handle communication if our primary email is compromised? A: Use the pre-established out-of-band communication channel documented in Section 2. Do not use company-issued email if the integrity of the mail server is in question.