Incident Response Plan
Scope and severity
[Severity trigger]
Detection and intake
[Primary and backup contact]
Roles and command
[Decision authority]
First 15 minutes
[Customer notification threshold]
Containment
[Containment command]
Communication
[Recovery verification and handoff]
Recovery
[Recovery: decision, evidence, owner, constraints, and next action]
Evidence and compliance
[Evidence and compliance: decision, evidence, owner, constraints, and next action]
Post-incident review
[Post-incident review: decision, evidence, owner, constraints, and next action]
Measurement and Ownership
| Measure or deliverable | Baseline or input | Target or acceptance condition | Source | Owner | Review date |
|---|---|---|---|---|---|
| [Time to detect] | [Current state] | [Target or acceptance condition] | [System or evidence source] | [Accountable role] | [Date] |
| [Time to acknowledge] | [Current state] | [Target or acceptance condition] | [System or evidence source] | [Accountable role] | [Date] |
| [Time to contain] | [Current state] | [Target or acceptance condition] | [System or evidence source] | [Accountable role] | [Date] |
| [Time to recover] | [Current state] | [Target or acceptance condition] | [System or evidence source] | [Accountable role] | [Date] |
| [Notification timeliness] | [Current state] | [Target or acceptance condition] | [System or evidence source] | [Accountable role] | [Date] |