Chapter 8 — Incident response planning
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 The plan"]
N2["8.2 Roles"]
N3["8.3 Severity"]
N4["8.4 Playbooks"]
N5["8.5 Communications"]
N6["8.6 Exercises"]
N7["Contact lists and access"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 The plan"]
N2["8.2 Roles"]
N3["8.3 Severity"]
N4["8.4 Playbooks"]
N5["8.5 Communications"]
N6["8.6 Exercises"]
N7["Contact lists and access"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 The plan]
|
v
[8.2 Roles]
|
v
[8.3 Severity]
|
v
[8.4 Playbooks]
|
v
[8.5 Communications]
|
v
[8.6 Exercises]
|
v
[Contact lists and access]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) write an incident response plan aligned with SP 800-61r3; (2) define roles and severity; (3) prepare playbooks for likely incidents; (4) plan communications and legal duties.
8.1 The plan
Priya's plan follows NIST SP 800-61r3 (Nelson et al., 2025), which places response within CSF 2.0 functions, from preparation to recovery and improvement. Following SP 800-61r3 helps Priya build the plan around the whole lifecycle, from preparing contacts and playbooks to learning from each incident. March showed gaps at every stage: no preparation, no authority, no plan for containment and no review afterwards. The plan addresses each one, and it is tested in tabletop exercises with managers. The managing director approves the plan, and Priya reviews it after every incident and exercise.
8.2 Roles
Incident lead (Priya), analyst (Tom or provider), IT operations, communications (marketing head), legal and data protection (external adviser), executive approver (managing director). Naming roles in advance avoids the confusion of deciding who does what during an incident. Priya leads and makes decisions, the analyst investigates, IT operations takes technical actions, communications handles messages to staff and customers, the external adviser advises on legal duties, and the managing director approves major decisions such as notifying customers. Each role has a deputy, and contact details are kept in the plan.
8.3 Severity
Low: single device or account, no data. Medium: data access or several systems. High: production stopped or sensitive data taken. Severity decides who is involved and how quickly. Under this scale, March would be high, because design files under customer confidentiality agreements were taken. A single phished account with no data accessed, like the month-nine incident, would be low. Priya's plan links each level to the people who must be informed and the actions expected, so the response matches the harm.
8.4 Playbooks
Three playbooks: compromised account, ransomware on office PCs, and suspected data theft. Each lists triggers, first steps, pre-approved actions and contacts. The three playbooks cover the incidents Fenwick considers most likely: March was a compromised account followed by data theft, and ransomware is a common threat to manufacturers. Each playbook gives the first steps so the responder does not have to decide everything under pressure. Pre-approved actions match the charter. The playbooks are tested in tabletop exercises and updated after each one.
8.5 Communications
Templates for staff, customers and regulators. Personal data breaches may need reporting to the data protection regulator within set deadlines, so the adviser is called early. Prepared templates save time when deadlines apply. Customer templates matter at Fenwick because design files may include customer drawings under confidentiality agreements, which the first tabletop showed nobody had checked. Legal added a step to check contracts for notification duties to customers when design data is accessed. The adviser decides whether a regulator must be notified, using the facts in the incident record.
8.6 Exercises
A tabletop exercise each half year tests the plan with managers. Each tabletop uses a realistic scenario, starting with a replay of March, and the managers who would respond work through the plan step by step. Gaps found become actions with owners and dates, such as the contract check legal added after the first exercise. Priya reports the findings and their status to the board. By the end of the year two tabletops had been held, and two of three findings from the first were closed.
Contact lists and access
The plan includes a printed contact list, out-of-band communication (personal phones and a messaging group created in advance), and emergency admin accounts kept in a sealed envelope in the safe. If the domain is compromised, normal email and accounts may not be trustworthy, so the response team must be able to talk and act without them. Priya tests the emergency accounts each quarter and records the test.
Recovery
Each playbook ends with recovery steps: restore from backup, reset credentials, confirm monitoring and return systems to users with sign-off.
Worked example
The first tabletop replays March. Managers realise nobody knew whether the design files included customer drawings under confidentiality agreements. Legal adds a step: check contracts for notification duties to customers when design data is accessed.
Synthetic case. The plan and exercise are invented.
Errors and limits
Plans age; review after each incident and exercise.
Exercises
- EX036 — Plan basis. What does the plan follow? Rubric: 3 = SP 800-61r3 within CSF 2.0; 2 = partial; 1 = vague; 0 = none.
- EX037 — Roles list. Name five incident roles. Rubric: 3 = lead, analyst, IT ops, comms, legal/DP, approver (five); 2 = three; 1 = one; 0 = none.
- EX038 — Playbooks. List the three playbooks. Rubric: 3 = compromised account; ransomware; data theft; 2 = two; 1 = one; 0 = none.
- EX039 — Tabletop finding. What did the tabletop reveal? Rubric: 3 = unknown if designs had customer confidentiality duties; step added; 2 = partial; 1 = vague; 0 = none.
- EX040 — Early adviser. Why call the data protection adviser early? Rubric: 3 = reporting deadlines for personal data breaches; 2 = partial; 1 = vague; 0 = none.
Synthesis
A response plan names roles, sets severity, holds playbooks and is tested.
Continue studying — chapter 08 of 12
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →