Security Incident Report Sample

Standard Operating Procedure: Enterprise Information Security Incident Response & Reporting

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Clinical Statement of Operational Boundaries

This Standard Operating Procedure (SOP) dictates the mandatory lifecycle for identifying, containing, eradicating, recovering from, and reporting information security incidents across all enterprise computing environments, cloud workloads, and physical infrastructures. Adherence to this protocol is compulsory for all internal personnel, third-party vendors, and managed service providers.

2.2 Regulatory & Compliance Standards

Operations governed by this document must strictly comply with, and maintain audit-readiness for, the following regulatory frameworks:

• NIST SP 800-61 Revision 2: Computer Security Incident Handling Guide.
• ISO/IEC 27001:2022 / ISO/IEC 27035: Information Security Incident Management.
• Payment Card Industry Data Security Standard (PCI-DSS v4.0): Requirement 12.10 (Incident Response).
• Health Insurance Portability and Accountability Act (HIPAA): Security Rule (45 CFR § 164.308(a)(6)).
• General Data Protection Regulation (GDPR): Articles 33 and 34 (Mandatory Breach Notification).
• California Consumer Privacy Act (CCPA) / CPRA: Statutory security incident disclosure protocols.

---

3. Prerequisites & Tool Requirements

Execution of this SOP requires pre-authorized access, specialized software utilities, and verified credentials across the incident response (IR) team.

3.1 Software Access & Enterprise Platforms

• Security Information and Event Management (SIEM): Splunk Enterprise Security / Microsoft Sentinel (Full Admin / Tier 3 Analyst).
• Endpoint Detection and Response (EDR): CrowdStrike Falcon / Microsoft Defender for Endpoint (Isolation & Forensics capability).
• Cloud Infrastructure Management: AWS IAM / Azure Active Directory / GCP Console (Global Security Administrator role).
• Ticketing & Case Management: Jira Service Management / ServiceNow GRC Security Operations Module.
• Forensic Capture Utilities: Volatility Framework, FTK Imager, Wireshark, Autopsy.

3.2 Certifications & Qualifications

• Personnel leading triage must hold active certifications: CISSP, GIAC Certified Incident Handler (GCIH), or CompTIA Advanced Security Practitioner (CASP+).

3.3 Safety & Physical PPE

• For physical data center breaches or IoT edge-device seizures: ESD grounding wrist straps, anti-static evidence bags, tamper-evident seals, and chain-of-custody documentation ledgers.

---

4. Roles & Responsibilities (RACI Matrix Table)

Definitions: R = Responsible (The doer), A = Accountable (The owner), C = Consulted (The advisor), I = Informed (The kept-up-to-date).

---

5. Step-by-Step Operational Procedure

Phase 1: Identification & Triage

• 1.1 Receive anomaly notification via SIEM automated alert, external research, or employee whistle-blower report.
• 1.2 Open a high-priority incident ticket in ServiceNow/Jira, assigning the unique alphanumeric Incident ID (e.g., INC-2026-XXXX).
• 1.3 Assess the scope, vector, and potential impact on business-critical assets using the Enterprise Impact Matrix.
• 1.4 Classify the incident severity level (Sev-1: Critical Enterprise Compromise; Sev-2: Significant Localized Breach; Sev-3: Minor Non-Systemic Event).

Phase 2: Containment Execution

• 2.1 Short-term Containment: Execute network isolation protocols via EDR (e.g., CrowdStrike Device Containment) for all compromised endpoints.
• 2.2 Revoke active sessions, OAuth tokens, and password credentials for all compromised user identities and service accounts via Active Directory / Azure AD.
• 2.3 Implement emergency firewall or Security Group (SG) rules to sever command-and-control (C2) communication channels.
• 2.4 Preservation: Generate memory dumps, disk images, and network packet captures (PCAP) of affected nodes prior to remediation, maintaining strict chain-of-custody logs.

Phase 3: Eradication & Recovery

• 3.1 Identify and isolate the root vulnerability (e.g., unpatched CVE, compromised credential, insider threat vector).
• 3.2 Purge malware artifacts, unauthorized user accounts, modified registry keys, and rootkits across all impacted systems.
• 3.3 Patch identified vulnerabilities, update access control lists (ACLs), and harden system configurations per CIS benchmarks.
• 3.4 Restore data from verified, malware-free immutable backups executed prior to the known point of compromise.
• 3.5 Bring systems back into production incrementally, initiating 72 hours of heightened log monitoring and behavioral anomaly detection.

Phase 4: Formal Incident Reporting & Closure

• 4.1 Compile all forensic timelines, SIEM queries, and containment logs into the final master incident report repository.
• 4.2 If Personally Identifiable Information (PII) or Protected Health Information (PHI) is compromised, draft the regulatory notification for Legal Counsel review within mandated timelines (e.g., GDPR 72-hour window).
• 4.3 Conduct a mandatory cross-functional Post-Incident Review (PIR) / "Lessons Learned" meeting within 5 business days of incident closure.
• 4.4 Close the incident ticket in the management system only after CISO sign-off and verification of all remediation action items.

---

6. Quality Assurance & Verification Criteria

To ensure institutional rigor, every incident lifecycle must clear the following validation gates prior to ticket closure.

6.1 Audit Checklist

• Chain of Custody Verification: All acquired forensic artifacts are cryptographically hashed (SHA-256) and logged in the digital evidence ledger.
• Containment Integrity: Zero active network traffic persists between isolated assets and external threat actor IP ranges or domains.
• Root Cause Identification: The exact vector of entry is documented with CVE or MITRE ATT&CK technique mapping.
• Regulatory Compliance Sign-off: Legal counsel has approved all external communications and regulatory disclosures.

6.2 Tolerance Thresholds & Benchmarks

• Mean Time to Detect (MTTD): $\le 15$ minutes from initial exploit execution.
• Mean Time to Contain (MTTC): $\le 60$ minutes for Sev-1 critical incidents.
• Forensic Preservation Integrity: 100% hash match validation (SHA-256) between live capture and storage repository.

---

7. Practical Troubleshooting Scenarios

Scenario A: EDR Host Isolation Fails Due to C2 Link Severance

• Symptom: Attempting to execute remote network isolation via the EDR console fails because the threat actor has terminated the agent daemon or network routing is blocked.
• Immediate Corrective Action Protocol:
  1. Issue an emergency out-of-band request to the physical or cloud network operations team to drop the switch port or terminate the virtual machine’s Virtual Network Interface Card (vNIC) at the hypervisor level.
  2. If cloud-hosted (AWS/Azure), apply a Deny-All Network Security Group (NSG) explicitly targeting the resource's IP address.
  3. Dispatch physical on-site infrastructure personnel to sever physical Ethernet cabling if hypervisor access is compromised.

Scenario B: Evidence Integrity Failure / Cryptographic Hash Mismatch

• Symptom: Verification of a forensic disk image yields a SHA-256 hash that does not match the value generated immediately post-acquisition, indicating potential corruption or tampering.
• Immediate Corrective Action Protocol:
  1. Halt all analysis operations on the corrupted image immediately.
  2. Quarantine the storage media containing the compromised image in a Faraday bag or secure write-blocked vault.
  3. Re-acquire the forensic image directly from the secondary source/backup or perform a fresh physical acquisition using a hardware write-blocker, logging a formal deviation note in the chain-of-custody ledger.

Scenario C: Active Data Exfiltration Detected During Containment

• Symptom: During triage, SIEM telemetry reveals active outbound data transmission of encrypted blobs to an external IP address.
• Immediate Corrective Action Protocol:
  1. Do not wait for complete isolation workflows; immediately trigger the enterprise Border Gateway Protocol (BGP) blackhole or explicit firewall drop rule for the destination IP address.
  2. Force-terminate the autonomous system path or upstream ISP transit interface if exfiltration spans multiple external endpoints.
  3. Notify the CISO and Legal Counsel immediately to initiate dynamic data breach impact calculations.