Incident Response Plan Example

Standard Operating Procedure: Enterprise Incident Response Plan (IRP)

1. Document Control Block

• Document ID: SOP-SEC-042
• Effective Date: October 24, 2023
• Version: 4.1.0
• Review Cadence: Semi-Annual (Next Review: April 24, 2024)
• Owner: Chief Architect, Template Registry (Julian Vance)
• Classification: Internal / Restricted

---

2. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional framework for detecting, containing, eradicating, and recovering from security incidents affecting Template Registry infrastructure, services, and data. The purpose of this document is to ensure a standardized, repeatable, and legally compliant methodology that minimizes system downtime, data loss, and operational risk while maintaining forensic integrity.

---

3. Scope & Prerequisites

Scope

This procedure applies to all production environments, staging infrastructure, corporate networks, and employee endpoints managed by Template Registry.

Prerequisites & Required Toolset

• Access Control: Privileged access management (PAM) credentials, multi-factor authentication (MFA) tokens, and administrative keys for AWS/GCP/Kubernetes.
• Software & Tooling:
  • SIEM / Log Aggregation (Datadog, Splunk)
  • Endpoint Detection and Response (EDR - CrowdStrike Falcon)
  • Incident Management Platform (PagerDuty, Jira Service Management)
  • Out-of-band communication channel (Signal, dedicated PagerDuty Bridge)
  • Forensic acquisition tools (dd, FTK Imager, Volatility)

---

4. Roles & Responsibilities (RACI Matrix)

(R = Responsible, A = Accountable, C = Consulted, I = Informed)

---

5. Step-by-Step Procedure

Phase 1: Identification & Triage

• Receive alert via automated SIEM/EDR trigger or manual employee report.
• Acknowledge PagerDuty alert within 5 minutes of paging.
• Open a dedicated Incident Bridge (audio/video) and corresponding Jira ticket.
• Triage the alert to determine severity level (Sev 1: Critical System Compromise, Sev 2: Major Service Degradation, Sev 3: Minor/Non-Core Issue).
• Declare Incident State officially and assign the Incident Commander (IC) role.

Phase 2: Containment

• Implement short-term containment measures to halt lateral movement (e.g., isolate compromised EC2 instances via Security Group revocation, terminate active sessions).
• Preserve system state for forensics (do not reboot compromised nodes without memory dumps).
• Capture volatile memory and snapshot persistent storage volumes for forensic analysis.
• Verify that isolation steps have successfully severed the attacker's Command and Control (C2) channels.

Phase 3: Eradication

• Identify root vulnerability or vector of entry (e.g., unpatched CVE, compromised credential, supply chain injection).
• Remove malicious artifacts, unauthorized user accounts, modified binaries, and backdoors from affected systems.
• Patch underlying vulnerabilities or apply compensatory network controls (WAF rules, firewall blocks).
• Rotate all credentials, API keys, and service tokens associated with compromised assets.

Phase 4: Recovery

• Rebuild systems from verified, uncompromised golden images or Infrastructure-as-Code (Terraform) pipelines.
• Reintroduce assets to production in a phased manner (canary deployments).
• Enable enhanced logging and monitoring on recovered systems to detect recurrence.
• Conduct integrity checks, vulnerability scans, and functional smoke tests to confirm service health.
• Officially declare the incident closed and terminate the Incident Bridge.

Phase 5: Post-Incident Review (PIR)

• Schedule mandatory PIR meeting within 48 hours of incident closure.
• Produce a comprehensive Timeline of Events, Root Cause Analysis (RCA), and Impact Assessment.
• Assign action items for engineering remediation with strict SLAs (Sev 1 items: < 7 days).
• Archive all forensic artifacts, communication logs, and Jira tickets in the secure compliance repository.

---

6. Quality Assurance & Pro-Tips

Best Practices

• Preserve Evidence First: Prioritize memory capture and disk snapshots over rapid remediation to ensure forensic viability.
• Single Source of Truth: Maintain real-time updates exclusively in the designated incident ticket and status page. Do not fragment updates across ad-hoc chats.

Common Pitfalls

• Premature Remediation: Eradicating threats before capturing forensic state destroys critical attribution evidence.
• Communication Silos: Failing to engage Legal/PR early during potential PII/PHI data exfiltration events.

Metric Thresholds

• Mean Time to Acknowledge (MTTA): < 5 minutes for Sev 1.
• Mean Time to Contain (MTTC): < 30 minutes for Sev 1.
• PIR Completion SLA: < 48 hours post-incident.

---

7. Frequently Asked Questions (FAQ)

Q: Who possesses the authority to shut down public-facing production infrastructure during an active containment phase?
A: The Incident Commander (IC) holds absolute operational authority to sever public ingress or shut down core infrastructure to mitigate active data loss or systemic compromise.

Q: When must regulatory bodies or external stakeholders be notified of a security breach?
A: Legal and Compliance must be engaged immediately upon confirming unauthorized access to customer data, PII, or financial records. External disclosures are strictly governed by jurisdictional compliance frameworks (e.g., GDPR, CCPA) and orchestrated exclusively by Legal and Executive Leadership.