Incident Response Plan

How to structure incident response documents so they work under pressure: one master plan for what every incident shares, a playbook for each of 12 incident domains, supporting policies underneath, and severity routing that connects them.

What to do when an account is compromised: revoke sessions and tokens, not just the password; remove attacker MFA and app access; work out what the identity could reach; and hunt for the persistence attackers leave behind.

A practical data breach response plan: preserve the evidence, record when you became aware, count people rather than rows, assess the harm, and meet the notification clocks under GDPR, Australia’s NDB scheme, SEC rules, HIPAA and US state laws.

How to respond to a network intrusion: capture evidence from an exploited VPN or firewall before patching, treat credentials that passed through it as stolen, decide what to isolate and how far, and recover from a domain compromise.

How to respond to a software supply chain incident: find every build and machine that ran the bad package, rotate secrets in the right order, check whether your own releases were tampered with, and tell downstream users when they were.

How to respond to a cloud account breach: deactivate a leaked key without destroying the evidence, hunt for the persistence attackers create in IAM, close the gaps in your logging, and scope what was read from storage.

How incident response changes when industrial control systems are involved: who has authority over the process, how to reach a safe state, when it is safe to isolate each kind of OT system, and how to recover controllers from known-good copies.