Nis2 Incident Response Plan Template

Standard Operating Procedure: NIS2 Incident Response Plan (IRP)

1. Executive Summary & Purpose

This SOP establishes the incident response framework for Template Registry to ensure compliance with the EU NIS2 Directive. Its purpose is to standardize the identification, containment, and reporting of significant incidents within the statutory 24-hour early warning and 72-hour incident notification windows.

2. Scope & Prerequisites

• Scope: Applies to all critical information systems, network infrastructure, and digital services managed by Template Registry.
• Required Tools: SIEM (Security Information and Event Management), EDR (Endpoint Detection and Response), Out-of-Band Communication (Signal/Encrypted Matrix), Incident Management Portal (Jira/ServiceNow).
• Software: Immutable backup logs, Forensic imaging tools (FTK/EnCase), Vulnerability scanners.

3. Roles & Responsibilities (RACI Matrix)

4. Step-by-Step Procedure

Phase 1: Detection & Triage

• Monitor SIEM/EDR alerts for indicators of compromise (IoC).
• Determine if the incident meets the NIS2 "significant" criteria (impact on services, duration, number of users, cross-border impact).
• Open an Incident Case File in the secure management portal.

Phase 2: Containment (Initial & Long-term)

• Execute network isolation on compromised assets.
• Revoke compromised credentials and rotate privileged access keys.
• Deploy "Snapshot" forensic images for evidence preservation.

Phase 3: Eradication & Recovery

• Identify the root cause (malware, misconfiguration, insider threat).
• Rebuild systems from hardened, immutable golden images.
• Validate system integrity via vulnerability scan before re-connecting to production.

Phase 4: NIS2 Reporting

• T+24 Hours: Submit "Early Warning" to the National CSIRT (via NIS2 portal).
• T+72 Hours: Submit "Incident Notification" including updated severity assessment and mitigation measures.
• Final Report: Submit comprehensive incident report (within 1 month post-incident).

5. Quality Assurance & Pro-Tips

• Metric Thresholds: Mean Time to Detect (MTTD) < 4 hours; Mean Time to Contain (MTTC) < 2 hours.
• Pro-Tip (The Julian Vance Standard): Do not wait for 100% data fidelity to issue the 24-hour warning. NIS2 authorities prefer an incomplete, timely report over a perfect, late one.
• Common Pitfall: Failing to log the "time of discovery." Inconsistencies here will lead to regulatory non-compliance during the audit phase.
• Quality Gate: Every incident ticket must be closed by the CISO or delegate, ensuring all artifacts are attached to the audit trail.

6. Frequently Asked Questions

Q: What constitutes a "significant" incident under NIS2? A: An incident is significant if it causes severe operational disruption, results in substantial financial loss, or impacts a significant number of users. If in doubt, treat as significant to trigger the 24-hour notification process.

Q: Are we legally required to disclose the identity of the threat actor? A: No. NIS2 mandates focus on the nature of the incident, its impact, and the mitigating measures. If the threat actor is unknown, report "Unknown/Under Investigation" rather than speculating.

Authorized by: Julian Vance Chief Architect, Template Registry