cyber security incident response policy template

Enterprise Cyber Security Incident Response Framework

Document Control

• Document ID: [__________]
• Version: [__________]
• Effective Date: [__________]
• Review Cycle: [Annual/Bi-Annual]

1. Purpose & Scope

The purpose of this document is to establish a standardized framework for detecting, responding to, and recovering from information security incidents. This policy applies to all employees, contractors, and third-party vendors with access to the information systems owned or operated by [Company Name].

2. Prerequisites

Before executing this procedure, ensure the following are available:

• Incident Response Team (IRT) contact list: [Internal/Secure Location]
• Access credentials: Privileged accounts for [SIEM/EDR/Network Infrastructure]
• Communication channels: [Out-of-band communication platform, e.g., Signal/Encrypted Slack]
• Evidence preservation tools: [Forensic imaging software/Log aggregation platform]

3. Roles & Responsibilities (RACI)

4. Step-by-Step Procedure

Phase 1: Identification & Triage

• Verify the report of a potential incident via [Primary Monitoring Tool].
• Determine the scope (e.g., single workstation vs. entire production environment).
• Assign an Incident Severity Level: [Low/Medium/High/Critical].
• Log initial findings in the Incident Tracking System: [Link to System].

Phase 2: Containment

• Execute short-term containment: [e.g., isolate affected VLANs/disable compromised accounts].
• Capture volatile memory/system state for forensic analysis.
• Verify that containment measures have not caused secondary system failure.

Phase 3: Eradication

• Identify the root cause (e.g., malware, unauthorized access, misconfiguration).
• Remove the threat (e.g., wipe/re-image systems, patch vulnerabilities, reset credentials).
• Conduct a deep-scan of the environment to ensure no persistent backdoors remain.

Phase 4: Recovery

• Restore services from verified clean backups.
• Monitor systems for anomalous behavior post-restoration.
• Validate system integrity with [Security Team Lead].

Phase 5: Lessons Learned

• Conduct a post-incident review meeting within [Number] days.
• Document the timeline, response efficacy, and gaps identified.
• Update [Company Name] security controls based on findings.

5. Quality Assurance, Pro-Tips, & Pitfalls

• Pro-Tip: Never use production email systems to discuss an active breach, as the attacker may be monitoring your communications. Use your designated out-of-band channel.
• QA: Ensure all timestamps are recorded in UTC to maintain consistency across global logs.
• Common Pitfall: Failing to preserve logs before re-imaging machines. Always prioritize "Capture before Clean."

6. FAQs

Q: When should I escalate an incident to the Incident Commander? A: Escalate immediately if the incident involves PII/PHI, potential financial loss, or unauthorized access to administrative credentials.

Q: Who is authorized to speak to the press regarding an incident? A: Only the designated [Company Spokesperson/PR Lead] is authorized. All other staff should redirect inquiries to the PR department without comment.