Incident response, as one map
Good incident response is three layers. One master plan that everyone shares: who is in charge, how bad it is, who gets told, and who decides on notification. A playbook per incident type — ransomware, identity, cloud, email fraud and the rest — with the technical steps for that kind of attack. And policies underneath: backups you have tested, evidence you can trust, and a way to talk to the outside world.
Tap any box in the map to see when to open that playbook, the deadlines that often apply, and the free resources for it.
- 14 checklists
- 27 tools
- 29 labs
- 7 guides
- 5 policy builders
- 12 playbooks
The topology
Tap any box to see its triggers, clocks and resources.
Master incident response plan
Roles, severity levels, escalation, communications, legal and notification decisions, and lessons learned: the part every incident shares.
When it applies
- Any confirmed or suspected security incident
Every domain playbook below refers back to this plan for severity, escalation, communications and notification decisions. Only the technical steps change by incident type.
Checklists, tools, labs and guides
Tick what you are seeing and get a SEV1–SEV4 level, the playbooks to open, who to wake up and the clocks that may apply.
Score readiness across the master plan, all 12 domain playbooks and the supporting policies, and see your three weakest areas.
Build the master incident response plan from guided questions.
Classroom capstone: a phished login cascades into cloud keys, a customer data export, extortion and notification clocks. Up to 12 decisions across four playbooks.
Run an incident from first alert to lessons learned, with an AI coach and a shareable scorecard.
Practise running a tabletop exercise for executives.
Investigate artefacts and build the timeline.
Handle press, customers and staff while the incident is still unfolding.
Everything in the incident response suite
Filter by type. Each card shows which playbook it belongs to.
Check the shared core of your IR plan: roles, severity, escalation, privilege, notification decisions, evidence, recovery and testing.
Scope, contain (sessions, tokens, MFA, OAuth grants, keys), remove persistence, recover, notify and harden.
Bank recall first, then mailbox rules and forwarding, scope, supplier call-back, reporting, insurer and payment controls.
34 steps from awareness to close-out: preserve, contain the exfiltration path, scope, assess harm, decide each notification, communicate.
Edge device triage, evidence before reboot, segment isolation, AD eviction with the krbtgt double reset, C2 blocking, rebuild and monitoring.
Freeze pipelines, revoke CI tokens, deploy keys and OIDC trust, rebuild runners, verify artefacts and notify downstream consumers.
Provider-neutral steps with AWS, Azure and Google Cloud examples: revoke keys and live sessions, snapshot before terminating, preserve logs, sweep every region.
Safety first: who can stop the process, engineering on the team, no scanning fragile devices, OT evidence, IT/OT isolation and restoring logic from known-good.
31 steps: verify, cut or restrict vendor access, hunt in your logs, get facts in writing, meet your duties, re-assess the supplier.
Prompt injection, AI data leakage, agent tool misuse and poisoned MCP servers: kill switch, evidence, rollback, notification.
HR and legal first, evidence, proportionate monitoring, access-removal timing, departing-employee data and subject privacy.
Thirty weighted questions that surface past and ongoing breaches at a target: incident register, notifications, insurance claims, dark-web exposure, compromise assessment and litigation.
Who leads an incident at the acquired company on Day 1: command, merged on-call, retainer and insurer notice, interim severity model, notification owner, log access and TSA terms.
Evidence register with SHA-256 hashes and UTC times, a transfer log with hash verification and a handling checklist.
Tick what you are seeing and get a SEV1–SEV4 level, the playbooks to open, who to wake up and the clocks that may apply.
Score readiness across the master plan, all 12 domain playbooks and the supporting policies, and see your three weakest areas.
Build the master incident response plan from guided questions.
What a compromised account can reach, containment in priority order with time estimates, and a severity hint.
What to do when credentials or keys turn up in a leak.
An honest recall-likelihood band, who to call in order, and a mailbox triage checklist.
Check whether your policy actually covers payment fraud.
Every deadline from the moment you became aware — GDPR, SEC, NIS2, DORA, HIPAA, NDB, PIPEDA, PDPA, US states — sorted, with a countdown.
Tables and row counts to unique people, a sensitivity tier, the regimes likely to trigger and a rough cost range.
Paste your breach response plan: 31 elements found, partly or missing, common traps, a score and the five fixes to make first. Runs in your browser.
Who to notify after a breach, by regulator and region.
Estimate what a breach costs.
Guides and tools for every stage of a ransomware attack.
Score how ready you are before it happens.
The legal, insurance and practical questions before any payment.
Per segment: isolate now, contain and monitor, or full disconnect — with reasons, the cost of each option and what to capture first.
Many secrets leaked at once: an ordered rotation runbook by power, exposure and dependencies, verifying each new credential before revoking the old.
How CI/CD and repository attacks unfold.
Find secrets in code and config before attackers do.
Plan routine rotation of keys and secrets.
Tick the logs you have enabled and see which incident questions you could not answer, the retention gap and the fixes in priority order.
Sort OT assets into isolate now, isolate with an operator, monitor only, or shutdown decision, with the reasons and how to isolate each.
Put a number on plant downtime.
A vendor says it was breached: the questions email, your internal actions by integration, and whether your own clock has started.
Compare two companies' IR plans row by row and get gaps, conflicts, a Day-1 interim decision per row and a merged RACI to copy.
Check a target for an active intruder before close.
The full M&A cyber suite.
Classroom capstone: a phished login cascades into cloud keys, a customer data export, extortion and notification clocks. Up to 12 decisions across four playbooks.
Run an incident from first alert to lessons learned, with an AI coach and a shareable scorecard.
Practise running a tabletop exercise for executives.
Investigate artefacts and build the timeline.
Handle press, customers and staff while the incident is still unfolding.
A Global admin phished via adversary-in-the-middle: revoke-first, break-glass, persistence and the federation check.
Detect and respond to identity threats.
Contain a taken-over account step by step.
Respond to a credential-stuffing wave against your login.
A supplier bank-detail change, a payment made, and the fraud found 30 hours later.
Fix SPF, DKIM and DMARC so your domain is harder to spoof.
Your customer database is for sale on a forum: verify, scope, start the clocks, handle extortion, notify.
Spot and stop data leaving the network.
Work through the pay or not-pay decision.
An exploited SSL-VPN, a credential-harvesting webshell and a path to the domain controller. Patch first or image first?
Write and tune detection rules for intrusions.
A hijacked npm package steals CI secrets through a postinstall script. Scope the builds, rotate in order, rebuild and tell downstream.
An access key in a public repo, miners in unused regions and a customer bucket: branching decisions on keys, sessions, persistence, data and the bill.
Find and fix the cloud misconfigurations attackers use.
Ransomware reaches the plant historian and an engineering workstation: shut down or run manually, cut the IT/OT link, check controllers safely, restore.
See how an HMI compromise unfolds and how to respond.
Respond when a supplier is breached.
Tighten supplier contracts after an incident.
A support agent leaks other customers' orders via a poisoned ticket. Kill switch or prompt patch?
Tabletop an incident involving an AI agent.
A resigning engineer uploads designs to personal cloud: confront or preserve, monitor how far, remove access when.
Post-close, the acquirer finds an intruder that pre-dates closing. Branching decisions on command, evidence for the indemnity claim, integration freeze and notification as the new owner.
The target is breached between signing and closing.
Business impact analysis: what to restore first.
Master plan vs domain playbooks vs supporting policies, the 12 domains, and how severity routing connects them.
Revoke sessions and tokens, not just the password; work out what the identity could reach; hunt for persistence.
Preserve, scope people not rows, assess harm, and meet the GDPR, NDB, SEC, HIPAA and state clocks.
Exploited edge devices, lateral movement, how far to isolate, and recovering from a domain compromise.
Find every build that ran the bad package, rotate secrets in the right order, verify your own releases.
Deactivate leaked keys without losing evidence, hunt IAM persistence, close logging gaps, scope data reads.
Safety first: who holds authority over the process, what is safe to isolate, and recovering controllers.
Who is responsible and accountable for each response activity, the on-call roster with deputies, and the external contacts you will need.
Systems table with RPO, RTO, immutable and offline copies and restore tests; flags RPO gaps and overdue tests, with policy text.
Records schedule with legal basis, archive tier, deletion method and legal-hold override, and security logs kept long enough to investigate.
Pre-approved statements for six incident types, for customers, staff, media and regulators, plus the rules that keep them safe.
Blameless review with timeline, root cause, contributing factors, a tracked actions list, time to detect and resolve, and sign-off.
The model in brief
- One master incident response plan covers what every incident shares: who leads, severity levels, escalation, communications, legal and notification decisions, and lessons learned.
- 12 domain playbooks add the technical steps for each incident type: identity, email and BEC, data breach, ransomware, network, DevSecOps, cloud, OT/ICS, third party, AI systems, insiders and M&A.
- Supporting policies sit underneath: backup and restore testing, retention, evidence and chain of custody, crisis communications and post-incident review.
- 82 free checklists, tools, labs, guides and policy builders, each attached to the playbook it supports.
- Start with the Severity & Playbook Router during an incident, or the Readiness Scorecard before one.
Frequently asked questions
What is an incident response plan topology?
It is the shape of your incident response documentation: one master plan at the top that every incident uses, a set of playbooks for specific incident types underneath it, and the supporting policies they all rely on. Drawing it as a topology makes gaps visible — a playbook with no checklist, or a policy that nothing tests.
What is the difference between an IR plan and a playbook?
The plan covers decisions that do not change with the type of attack: who is in charge, how severity is set, who is told, who decides on notification and how lessons are learned. A playbook covers the technical steps for one incident type, such as revoking sessions in an identity compromise or restoring from immutable backups after ransomware. Playbooks refer back to the plan; they do not repeat it.
Which playbooks should we write first?
Those for the incidents you are most likely to have and least ready for. For most organisations that means identity compromise, email and business email compromise, ransomware and data breach. The Readiness Scorecard shows your three weakest areas so you can pick on evidence rather than instinct.
Where do regulatory notification deadlines fit?
In the master plan, as a decision process with a named owner, and in the playbooks most likely to trigger them — data breach in particular. Common examples include GDPR's 72 hours to the supervisory authority after becoming aware, NIS2's 24-hour early warning, and the SEC's four business days after determining materiality. Which apply depends on your organisation and the facts; confirm with counsel.
Are these tools free?
Yes. Every checklist, tool, lab and guide here is free to use and customise in your browser. Exporting a generated document (Word, PDF, Markdown or CSV) from the checklist and policy-builder templates is part of any PlayCISO paid plan.