Our incident management guidance will help you plan, build, develop and maintain an effective cyber incident response capability as our adversaries evolve.
Incident Response (IR) - developing your plan
Your cyber security incident response plan should be the starting point for your incident handling process.
A basic incident response plan should include:
Key contacts
IR team/provider, IT, Senior Management, Legal, PR, HR, Insurance. Always consider the risk of people being unavailable - ideally include at least 2 contact methods and 2 or more people (or group) details.
This should be always available for urgent incident calls
Basic guidance on legal or regulatory requirements
When to engage legal support, HR, or follow careful evidence capture guidelines
This is a basic plan. Most of the topics and information discussed in this guidance should be documented in (or alongside) your IR plan.
To enhance your IR plan, look to include:
Simple checklists which can be used easily during an emergency
Forms for documenting and tracking the incident and for post-incident review, to ensure all key elements are captured
Include additional detail on the IR stages and more technical guidance on containing, analysing, remediating and recovering from the incident
Playbooks / guidance on specific types of incidents
In addition to an IR plan, you should also have inter-linked business continuity, disaster recovery and communications plans (covering internal and external communications).
