Incident Response Readiness Scorecard
Most organisations are ready for one kind of incident and guessing on the rest. Answer 48 short questions across the master plan, the 12 incident-type playbooks and the supporting policies. You get a score for each area, a bar chart of where you stand, and your three weakest areas with links to the checklist or lab that fixes them.
Master incident response plan
- We have a written IR plan with a named incident commander and deputy who have pre-approved authority to contain.
- Severity levels are defined in business terms and everyone (security, IT, legal, executives) uses the same scale.
- A named owner decides on regulatory and customer notification, and we record when we became aware.
- The plan was exercised in the last 12 months with executives, legal and communications in the room.
Identity compromise
- We can revoke all sessions and refresh tokens for a user, and reset their MFA, within 30 minutes.
- Alerts fire on new MFA methods, risky sign-ins and new OAuth app consents for privileged accounts.
- Break-glass admin accounts exist, are monitored, and are stored outside the identity provider they recover.
- We are told when staff credentials appear in breach dumps or infostealer logs, and we act on it.
Email and business email compromise
- Supplier bank-detail changes are verified by a call to a number we already hold, never one from the email.
- We can find and remove malicious inbox rules and forwarding across all mailboxes quickly.
- Finance knows how to reach our bank's fraud team to attempt a recall within hours of a fraudulent payment.
Data breach
- We know where our sensitive and personal data lives, and which systems log access to it.
- We can tell which records were accessed or exported in a given period from logs we keep long enough.
- Counsel and the privacy officer are engaged early, and notification decisions are documented with reasons.
- Templates for regulator and individual notifications are drafted and approved in advance.
Ransomware and extortion
- At least one backup copy is offline or immutable and cannot be deleted with production admin credentials.
- We have restored a critical system from backup in the last 6 months and timed it.
- The pay / don't-pay decision process is agreed in advance: who decides, legal and sanctions checks, insurer role.
- EDR covers servers as well as laptops, and can isolate hosts remotely.
Network breach
- Internet-facing VPNs, firewalls and edge appliances are inventoried and patched against known-exploited flaws quickly.
- We keep network and DNS logs long enough to trace lateral movement and command-and-control traffic.
- We can isolate a network segment, or cut the internet edge, without losing our own ability to respond.
DevSecOps and software supply chain
- We can rotate every CI/CD and deployment secret within a day, and know where each one is used.
- Dependencies are pinned and new packages are checked before use; we can find every service using a bad version.
- Release artefacts are signed or hash-verified, so tampering can be detected.
Cloud breach
- Cloud control-plane audit logs are on for every account and sent somewhere an attacker cannot delete them.
- We get alerts for new IAM users, roles or keys, public storage and unusual spend.
- Responders have pre-provisioned, least-privilege break-glass access to investigate every cloud account.
- We know our cloud provider's incident support route and what they will and will not do for us.
OT / ICS breach
- The IT/OT boundary is documented and we can separate the plant network from IT quickly and safely.
- OT incident steps are agreed with operations and safety, and put safety and continuity before evidence.
- We hold known-good copies of PLC logic and configurations to compare against and restore.
Third-party and SaaS breach
- We know which suppliers and SaaS platforms hold our data or have access to our systems.
- Contracts with key suppliers set breach-notice periods and cooperation duties.
- We can cut a supplier's access (accounts, API keys, VPN, integrations) quickly when they are breached.
AI system incident
- We have an inventory of AI features, agents, models, plugins and MCP servers in use.
- AI prompts, outputs and tool calls are logged well enough to investigate a leak or misuse.
- Each AI feature or agent can be switched off or reduced to read-only quickly.
Insider incident
- HR, legal and security have an agreed process for investigating an insider, with a small need-to-know circle.
- We watch for bulk downloads and transfers to personal accounts, especially around resignations.
- Access is removed on the day someone leaves, including SaaS, tokens and shared credentials.
M&A incidents
- Cyber due diligence includes a check for existing compromise before we connect to an acquired company.
- Deal terms cover breaches between signing and close: notification, cooperation and remedies.
- Acquired companies are covered by our IR plan and monitoring from Day 1, or there is a written interim plan.
Supporting policies
- Backup and restore testing is a written policy with a schedule and recorded results.
- Evidence handling and chain of custody are defined, and log retention supports investigations.
- A crisis communications policy sets who may speak, approval routes and pre-drafted statements.
- Post-incident reviews are required for serious incidents and their actions are tracked to closure.
What this scorecard is
- 48 yes / partly / no questions across 14 areas: the master IR plan, 12 incident-type playbooks and the supporting policies.
- Each area gets a 0–100 score; areas that do not apply to you (no OT, no acquisitions) can be marked not relevant and drop out of the overall score.
- Your three weakest areas are highlighted with links to the checklist, lab or policy builder for that playbook.
- Copy the result as plain text for a board pack or a planning ticket. Runs in your browser; nothing is uploaded.
Frequently asked questions
What does this scorecard measure?
Whether you are ready to respond, area by area: the shared master plan (roles, severity, notification decisions, exercises), each type of incident (identity, email and BEC, data breach, ransomware, network, DevSecOps, cloud, OT, third party, AI systems, insiders, M&A) and the supporting policies (backup testing, evidence, crisis communications, post-incident review).
How is the score calculated?
Yes counts 1, Partly counts 0.5 and No counts 0. An area score is the average of its questions times 100, with unanswered questions counted as No. The overall score is the average of the areas you have started and not marked as not relevant. It is a transparent heuristic for planning, not a benchmark.
How is this different from the Ransomware Readiness Scorecard?
The ransomware scorecard goes deep on one incident type. This one goes broad: a few questions on every playbook so you can see which ones need work first. If ransomware comes out weak here, use the ransomware scorecard next.
What should I do with the weakest three?
Open the linked checklist or lab for each, and assign one owner per area with a date. Fixing the weakest playbook usually does more than polishing the strongest. Re-run the scorecard after your next exercise.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.