Dod Incident Response Plan Template

Standard Operating Procedure: Department of Defense (DoD) Incident Response Plan (IRP) Execution

---

1. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the operational lifecycle for executing the Department of Defense (DoD) Incident Response Plan (IRP). Grounded in NIST SP 800-61 Rev. 2 and DoD Directive 8520.01, this document provides systems engineers, incident handlers, and cybersecurity service providers (CSSPs) with an institutional-grade framework to detect, contain, eradicate, recover from, and report cyber security incidents affecting DoD information systems and defense critical infrastructure. Adherence to this SOP ensures operational resilience, chain of custody preservation, and mandatory compliance with USCYBERCOM and JS-J6 reporting thresholds.

---

2. Scope & Prerequisites

2.1 Scope

This procedure applies to all enclave environments, cloud infrastructures, weapon systems platforms, and enterprise networks managed under Template Registry architecture guidelines.

2.2 Prerequisites & Tooling

• Access Requirements: Privileged Incident Responder (IR) role, active Common Access Card (CAC) with PKI authentication, and Tier-3 authorization within the Security Operations Center (SOC).
• Software Stack:
  • Endpoint Detection and Response (EDR) agents (CrowdStrike Falcon / Microsoft Defender for Endpoint).
  • Security Information and Event Management (SIEM) platform (Elastic Stack / Splunk Enterprise Security).
  • Forensic acquisition toolkit (FTK Imager, Volatility Foundation, Wireshark).
• Hardware/Storage: FIPS 140-2 validated write-blockers, secure Red-Data storage arrays for evidence lockers.

---

3. Roles & Responsibilities (RACI Matrix)

• R = Responsible (The role that performs the activity)
• A = Accountable (The role with final approval and ownership)
• C = Consulted (The role providing advisory input)
• I = Informed (The role kept updated on progress)

---

4. Step-by-Step Procedure

Phase 1: Preparation & Triage

• Verify functionality and logging integrity of SIEM and EDR platforms across all enclaves.
• Confirm baseline access to out-of-band management networks and secure communication channels (SIPRNet/JWICS where applicable).
• Triage incoming alerts using the DoD Cyber Incident Severity Model (Categories 1 through 7).

Phase 2: Identification & Analysis

• Isolate anomalous host or network telemetry identified via SIEM alert triggers.
• Capture volatile memory (RAM) and running processes using approved forensic tools prior to system reboot or power down.
• Establish and document the initial chain of custody using Form DD-2092 (or digital equivalent) for all acquired artifacts.
• Determine the vector of compromise, indicators of compromise (IoCs), and scope of lateral movement.

Phase 3: Containment

• Execute immediate Short-Term Containment: Isolate infected hosts from the network via EDR micro-segmentation or switch-port disabling to prevent propagation.
• Implement Long-Term Containment: Apply temporary firewall rule updates, block malicious IPs/domains at the perimeter gateway, and revoke compromised user credentials.
• Preserve forensic state by creating bit-stream disk images of compromised endpoints for deep-dive analysis.

Phase 4: Eradication

• Identify and remove root-cause vulnerabilities, backdoors, rootkits, and unauthorized user accounts introduced during the intrusion.
• Patch underlying vulnerabilities (OS, firmware, application layer) in alignment with current IAVA (Information Assurance Vulnerability Alert) mandates.
• Validate system integrity against known-good cryptographic hashes and golden system images.

Phase 5: Recovery

• Restore systems from verified, uncompromised backups or rebuild from baseline infrastructure-as-code templates.
• Reintroduce assets to the operational network under heightened monitoring (strict IDS/IPS and EDR tuning) for a minimum observation window of 72 hours.
• Perform continuous vulnerability scanning to verify remediation efficacy before returning systems to full operational status.

Phase 6: Post-Incident Reporting & Lessons Learned

• Submit the formal Cyber Incident Report (CIR) to the USCYBERCOM Joint Operations Center (JOC) within the mandatory 60-minute window for Cat 1-3 incidents.
• Compile all timeline data, forensic artifacts, and mitigation logs into the master ticket repository.
• Conduct an After Action Report (AAR) meeting with the Incident Response Team and System Owners within 5 business days of incident closure.

---

5. Quality Assurance & Pro-Tips

Best Practices (Pro-Tips)

• Preserve Evidence Integrity: Never interact with a live, compromised host using native administrative binaries (e.g., netstat, ps, regedit) as they may be trojanized. Always deploy static, cryptographically signed binaries from external media.
• Isolate, Don't Reboot: Unless operational safety requires a hard shutdown, isolate network access rather than powering down to preserve volatile memory artifacts for malware analysis.

Common Pitfalls to Avoid

• Premature Remediation: Eradicating malware before capturing system state destroys forensic evidence, potentially concealing the initial attack vector and allowing persistence mechanisms to remain undetected.
• Delayed Reporting: Waiting for complete internal consensus before notifying the designated CSSP or USCYBERCOM violates mandatory DoD reporting SLAs.

Metric Thresholds

• Mean Time to Detect (MTTD): $\le 15 \text{ minutes}$ from initial trigger to triage assignment.
• Mean Time to Contain (MTTC): $\le 60 \text{ minutes}$ for Category 2 (Root Access) and Category 3 (Data Exfiltration) incidents.
• Reporting SLA Compliance: $100%$ adherence to USCYBERCOM 60-minute notification mandates.

---

6. Frequently Asked Questions (FAQ)

Q1: What constitutes an immediate escalation to USCYBERCOM?
A: Any incident classified under Categories 1 (Root Level Intrusion), 2 (User Level Intrusion), 3 (Malicious Code), or incidents affecting Nuclear Command, Control, and Communications (NC3) systems require direct, immediate notification via the Defense Cyber Incident Reporting (DCIR) portal within 60 minutes of detection.

Q2: How should classified forensic evidence be handled during an active incident?
A: All forensic acquisitions derived from classified systems must be processed, stored, and transported in strict accordance with DoD Manual 5200.01, Volume 3 (Information Security Program). Use FIPS 140-2 validated encryption for any data-at-rest or in-transit involving classified operational artifacts.

Q3: What actions are required if the primary SIEM logging pipeline fails during an incident?
A: Immediately pivot to local host-based logging buffers, deploy secondary out-of-band packet capture (PCAP) taps, and notify the Chief Architect and Information System Security Manager (ISSM) within 30 minutes of logging degradation.