Incident Response Plan

# Incident Response Plan ## 1. Purpose This plan establishes procedures for detecting, responding to, and recovering from security incidents at **[Company Name]**. ## 2. Scope This plan covers all security incidents affecting **[Company Name]** systems, data, employees, or customers. ## 3. Severity Classification | Severity | Description | Examples | Response Time | |----------|-------------|----------|---------------| | **P1 — Critical** | Active data breach, system compromise | Customer data exfiltrated, ransomware, production down | **15 minutes** | | **P2 — High** | Significant threat, no confirmed breach | Malware detected, unauthorized access attempt succeeding | **1 hour** | | **P3 — Medium** | Potential threat requiring investigation | Suspicious login patterns, phishing email reported | **4 hours** | | **P4 — Low** | Minor issue, no immediate risk | Policy violation, failed brute force attempts | **24 hours** | ## 4. Incident Response Team | Role | Responsibility | Primary | Backup | |------|---------------|---------|--------| | **Incident Commander** | Overall coordination, decisions | [Name] | [Name] | | **Technical Lead** | Investigation, containment | [Name] | [Name] | | **Communications Lead** | Internal/external communications | [Name] | [Name] | | **Legal Counsel** | Regulatory, legal obligations | [Name] | [Name] | ## 5. Response Phases ### Phase 1: Detection & Triage (0-30 min) 1. Receive alert from monitoring, employee report, or external notification 2. Initial triage — confirm incident is real (not false positive) 3. Classify severity (P1-P4) 4. Activate incident response team for P1/P2 5. Create incident channel (e.g., #incident-YYYY-MM-DD in Slack) 6. Begin incident log with timestamps ### Phase 2: Containment (30 min - 2 hours) 1. **Short-term containment**: Isolate affected systems (network segmentation, disable accounts) 2. Preserve evidence (disk images, memory dumps, log snapshots) 3. Assess blast radius — what systems/data are affected? 4. Implement temporary workarounds to restore service if safe 5. Notify leadership for P1/P2 incidents ### Phase 3: Eradication (2-24 hours) 1. Identify root cause and attack vector 2. Remove malware, unauthorized access, compromised credentials 3. Patch vulnerable systems 4. Reset affected credentials 5. Verify no persistence mechanisms remain ### Phase 4: Recovery (24-72 hours) 1. Restore systems from clean backups if needed 2. Re-enable services in staged approach 3. Enhanced monitoring for recurrence 4. Verify data integrity 5. Confirm all indicators of compromise (IOCs) are resolved ### Phase 5: Post-Incident Review (within 5 business days) 1. Conduct blameless post-mortem meeting 2. Document timeline, root cause, impact, and actions taken 3. Identify lessons learned and improvement actions 4. Update runbooks and playbooks 5. File regulatory notifications if required (GDPR: 72h, HIPAA: 60 days) ## 6. Communication Templates ### Internal Notification (P1/P2) > **Security Incident Alert — [Severity]** > We have detected a security incident affecting [systems/data]. The incident response team has been activated. Please do not discuss this incident outside of #incident-[date]. Updates will be provided every [30 min / 1 hour]. ### Customer Notification (if data breach confirmed) > We are writing to inform you of a security incident that may have affected your data. We detected [brief description] on [date]. We immediately [actions taken]. [What data was affected]. [What we are doing]. [What you should do]. ## 7. Evidence Preservation All evidence must be preserved in accordance with legal hold requirements: - System logs (retain 1 year minimum) - Network packet captures - Disk and memory forensic images - Email communications related to the incident - Screenshots and notes ## 8. Regulatory Notifications | Regulation | Notification Deadline | Authority | |------------|----------------------|-----------| | GDPR | 72 hours | Supervisory Authority | | HIPAA | 60 days | HHS + affected individuals | | SOC 2 | Auditor notification at next assessment | Auditor | | State breach laws | Varies (typically 30-60 days) | State AG + affected individuals | --- *Approved by: [Name, Title]* *Effective Date: [Date]* *Version: 1.0*