Incident Response Plan.

What is an incident response plan?

An incident response plan is written guidance that tells an organization what to do when a cyber attack or other security incident happens. NIST defines it as the documentation of a predetermined set of instructions or procedures to detect, respond to, and limit the consequences of malicious cyber attacks against an organization’s information systems. NIST gives this definition in its glossary, citing SP 800-34 Rev. 1.

What does an incident response plan cover?

CISA describes the incident response process in phases, based on NIST SP 800-61 Rev. 2. The phases are preparation, detection and analysis, containment, eradication and recovery, and post-incident activities. CISA says many activities are iterative, so they may continue and change until the incident is closed out.

• Preparation: CISA says to document incident response plans, including the processes and procedures for naming a coordination lead, called the incident manager.
• Containment: CISA says the objective is to prevent further damage and reduce the immediate impact by removing the adversary’s access. It adds that the particular scenario drives the containment strategy.
• Post-incident activities: CISA says the goal is to document the incident, inform leadership, harden the environment to prevent similar incidents, and apply lessons learned to improve the handling of future incidents.

How do teams prepare before an incident?

CISA lists several preparation activities. They include understanding policies and procedures, setting up tools to detect suspicious activity, establishing staffing plans, and educating users on cyber threats and how to report them. CISA also says to define a baseline of normal activity, so defenders can spot deviations.

CISA also says to develop and test courses of action for containment and eradication. It says personnel should be trained, exercised, and ready to respond. It says policies and plans should cover notification, interaction, and evidence sharing with law enforcement.

What happens after an incident?

CISA describes a lessons-learned review, which it calls a hotwash. The review looks at how effective and efficient the incident handling was. It captures lessons learned, the initial root cause, problems carrying out the planned actions, and any missing policies and procedures. CISA also says to add detections for the attacker techniques that worked during the incident and to address blind spots in coverage.

Why does NIST treat incident response as part of risk management?

NIST SP 800-61 Rev. 3 aims to help organizations build incident response into their cybersecurity risk management. NIST says the goal is to help organizations prepare for incident responses, reduce the number and impact of incidents, and improve the efficiency and effectiveness of detection, response, and recovery.

Is an incident response plan the same as an incident response playbook?

Not always. CISA publishes an Incident Response Playbook for federal civilian agencies. It sets out a standardized response process for confirmed malicious cyber activity where a major incident has been declared or not yet ruled out. Whether an organization uses the word plan or playbook for its own document can differ. The common idea is written steps that people agree on before an incident.

Is an incident response plan only for large organizations?

The sources we read are written for government agencies, so they do not make a claim about organization size. As general reasoning, any organization that holds data or runs systems can benefit from agreeing on roles and steps before something goes wrong.

Related terms

Related terms include data breach and threat hunting.