Incident Response Plan Template Cisa

Standard Operating Procedure: Cybersecurity Incident Response Plan (IRP)

1. Executive Summary & Purpose

This document provides a standardized framework for detecting, analyzing, and mitigating cyber threats in alignment with CISA’s National Incident Response Plan (NIRP). The purpose is to minimize system downtime, protect data integrity, and ensure regulatory compliance through a unified operational posture.

2. Scope & Prerequisites

• Scope: All information systems, cloud infrastructure, and endpoints managed by Template Registry.
• Required Tools:
  • SIEM (Security Information and Event Management) platform.
  • Out-of-band communication (Encrypted Signal/Slack Enterprise).
  • Forensic imaging toolkit (FTK Imager/Magnet).
  • Asset inventory database (CMDB).
• Prerequisites: All IR team members must hold current security clearance and signed Non-Disclosure Agreements.

3. Roles & Responsibilities (RACI Matrix)

4. Step-by-Step Procedure

Phase 1: Detection & Analysis

• Validate alert trigger via SIEM log correlation.
• Determine the scope (Isolate affected subnets/hosts).
• Document initial indicators of compromise (IoCs).

Phase 2: Containment

• Initiate short-term containment (e.g., disable compromised credentials).
• Execute long-term containment (e.g., VLAN isolation, firewall blocks).
• Capture volatile memory and forensic snapshots before rebooting.

Phase 3: Eradication

• Identify root cause (e.g., patched vulnerability, phishing vector).
• Remove artifacts (Malware, unauthorized accounts, persistent backdoors).
• Validate integrity of system backups.

Phase 4: Recovery

• Restore services from "Known Good" configurations.
• Implement enhanced monitoring on recovered assets.
• Perform penetration testing/vulnerability scan on restored segment.

Phase 5: Post-Incident Activity

• Conduct a "Lessons Learned" briefing within 72 hours.
• Update the Incident Log and CMDB.
• File regulatory disclosures (if applicable, per CISA/CIRC requirements).

5. Quality Assurance & Pro-Tips

• Metric Thresholds: Mean Time to Detect (MTTD) < 4 hours; Mean Time to Contain (MTTC) < 2 hours.
• Pro-Tip (The "Golden Hour"): The first 60 minutes determine the breach severity. Do not wait for complete analysis before triggering containment protocols.
• Common Pitfall: Over-reliance on automation. Automated scripts often trip on polymorphic malware; maintain "manual override" capacity for all containment protocols.

6. Frequently Asked Questions

Q: At what point do I notify external regulatory bodies (e.g., CISA)? A: Notification is mandatory if the incident involves "Significant Cyber Incidents" as defined by CISA (e.g., unauthorized access to critical infrastructure, potential exfiltration of PII/PHI). Contact CISA via the Central Reporting System.

Q: Should I disconnect the affected server immediately? A: Depends. Disconnecting immediately may cause an attacker to trigger a "dead man's switch" (data wiper). If the threat is active, use network-level isolation (ACLs) rather than physical power-down to preserve volatile RAM.

Authorized by: Julian Vance Chief Architect, Template Registry