Template Security Incident Report

STANDARD OPERATING PROCEDURE: TEMPLATE SECURITY INCIDENT REPORT

Document Identifier: SOP-SEC-INF-042
Classification: Enterprise Internal / Restricted

---

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Purpose

This Standard Operating Procedure (SOP) dictates the mandatory lifecycle for documenting, escalating, triaging, and closing security incidents via the standardized Security Incident Report (SIR) template. It ensures systematic capture of forensic metadata, legal chain-of-custody, and root-cause analysis.

2.2 Operational Boundaries

This procedure applies universally across all enterprise corporate environments, cloud-native deployments (AWS, Azure, GCP), hybrid infrastructure, and third-party vendor integrations handling enterprise data assets.

2.3 Regulatory Standards & Compliance Alignment

Operations executed under this SOP must maintain strict compliance with:

• NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide.
• ISO/IEC 27001:2022: Information Security Management Systems (Clause A.16: Information Security Incident Management).
• GDPR (Art. 33/34) & CCPA: Data Breach Notification mandates.
• PCI-DSS v4.0: Requirement 12.10 (Incident Response Plan).

---

3. Prerequisites & Tool Requirements

3.1 Software & System Access

• SIEM / XDR Platform: Enterprise Sentinel/Splunk Enterprise Security (Read/Write triage access).
• Incident Management System (IMS): Jira Service Management / ServiceNow SecOps module.
• Forensic Capture Utilities: Volatility Framework, FTK Imager, Wireshark, or cloud-native equivalent instance snapshots.
• Secure Collaboration: Out-of-band encrypted communication channel (Signal Enterprise or Wickr).

3.2 Equipment & Safety PPE

• Air-gapped forensic workstation equipped with hardware write-blockers.
• Dedicated hardware token for Multi-Factor Authentication (MFA) meeting FIPS 140-2 Level 3 standards.

3.3 Certifications & Training

• Operators must hold active CISSP, GIAC GCIH, or CompTIA CySA+ certifications, coupled with annual internal tabletop exercise completion.

---

4. Roles & Responsibilities (RACI Matrix Table)

Legend: R = Responsible, A = Accountable, C = Consulted, I = Informed

---

5. Step-by-Step Operational Procedure

Phase 1: Detection, Triage, and Initialization

• 1.1 Receive automated or manual alert via SIEM/XDR; verify alert integrity to rule out false positives.
• 1.2 Open a new Security Incident Report (SIR) ticket within the IMS utilizing template form SEC-INC-TMPL-v2.
• 1.3 Assign the Initial Severity Level based on the Enterprise Impact Matrix (Sev-1: Critical Enterprise Impact, Sev-2: Major, Sev-3: Moderate, Sev-4: Minor).
• 1.4 Establish the cryptographic secure log capture timestamp (UTC) for all downstream evidentiary artifacts.

Phase 2: Containment, Eradication, and Evidence Preservation

• 2.1 Execute immediate containment protocols (e.g., host isolation, network segmentation, credential revocation) without destroying volatile memory.
• 2.2 Deploy forensic imaging tools to capture RAM, disk images, and live network connection states of compromised endpoints.
• 2.3 Compute cryptographic hashes (SHA-256) for all collected evidence items and log them in the evidence custody ledger.
• 2.4 Isolate and patch the primary vector of exploitation while maintaining staging environments for root-cause analysis.

Phase 3: Investigation, Root-Cause Analysis, and SIR Completion

• 3.1 Reconstruct the attack timeline using centralized log aggregation, mapping actions to the MITRE ATT&CK framework.
• 3.2 Complete all mandatory fields within the Security Incident Report (SIR) template:
  • Executive Summary of the event.
  • Indicators of Compromise (IoCs) including IP addresses, hashes, and domains.
  • Scope of data access and asset exposure inventory.
• 3.3 Conduct peer review of the draft SIR with the SOC Lead.

Phase 4: Escalation, Legal Review, and Closure

• 4.1 Trigger external notifications via Legal Counsel if Personal Identifiable Information (PII) or Protected Health Information (PHI) exposure thresholds are breached.
• 4.2 Submit the finalized SIR to the CISO for formal sign-off and closure.
• 4.3 Archive the ticket, securing all associated forensic artifacts in the cold-storage vault with a 7-year retention policy.

---

6. Quality Assurance & Verification Criteria

6.1 Audit Checklist

• Was the initial containment executed within the defined SLA threshold (Sev-1: < 15 minutes)?
• Are all collected IoCs validated against threat intelligence feeds to eliminate noise?
• Does the completed SIR contain zero placeholder text and complete chain-of-custody hashes?
• Have all temporary isolation rules been audited to prevent operational drift?

6.2 Tolerance Thresholds & Acceptance Benchmarks

• Time to Containment (TTC): Maximum 15 minutes for Sev-1; Maximum 60 minutes for Sev-2.
• SIR Documentation Accuracy: 100% adherence to required metadata fields; zero missing hash validations.
• Post-Incident Review Execution: Must be scheduled within 72 hours of incident closure.

---

7. Practical Troubleshooting Scenarios

Scenario A: Write-Blocker Failure During Live Forensic Acquisition

• Symptom: Hardware write-blocker reports device bus errors or fails to mount target drive securely during volatile RAM/disk acquisition.
• Immediate Corrective Action Protocol:
  1. Halt acquisition immediately to prevent kernel panic or accidental write operations to the suspect medium.
  2. Disconnect the physical interface and transition to a secondary, pre-calibrated software-level write-blocking mechanism (e.g., mount -o ro,noload under strict chain-of-custody protocols).
  3. Document the hardware failure within the SIR appendix, noting the exact device serial number, failure timestamp, and alternative tool employed.
  4. Recalculate and verify the resulting image hash integrity twice upon successful acquisition.

Scenario B: Stakeholder Communication Deadlock / Legal Privilege Block

• Symptom: Internal operations teams or third-party vendors refuse to share operational telemetry citing liability, delaying the compilation of the SIR.
• Immediate Corrective Action Protocol:
  1. Immediately elevate the block to the CISO and General Counsel to invoke legal privilege protocols (Attorney-Client / Work-Product Doctrine).
  2. Re-route data gathering through secure, counsel-directed channels where operational findings are funneled directly through legal representation.
  3. Note the obstruction and subsequent escalation path in the SIR audit trail to maintain strict regulatory accountability and timeline documentation.