An incident response capability reduces confusion during a high-pressure event. Preparation should happen before an alert arrives: define roles, decision authority, communication channels, evidence handling and recovery priorities. The plan should be usable by technical and business stakeholders.
Prepare people and procedures
Define incident severity levels, an incident commander, technical leads, communications owner, legal or privacy contacts and business service owners. Maintain current contact lists and out-of-band communication methods in case normal email or identity systems are compromised.
Detection and analysis
Validate the alert and establish what happened, when it began, which identities and assets are affected and whether the activity is continuing. Preserve relevant logs, endpoint evidence and cloud audit records. Maintain a timeline and distinguish confirmed facts from hypotheses.
Containment
Choose containment actions based on impact and business continuity. Options may include isolating endpoints, disabling compromised accounts, revoking sessions, blocking malicious indicators or restricting network paths. Avoid destructive actions that could erase evidence or interrupt critical services without appropriate approval.
Eradication and recovery
Remove persistence, close the exploited weakness, rotate exposed credentials and rebuild systems when trust cannot be restored. Recover from known-good backups, validate system integrity and monitor closely for recurrence. Restore services in business-priority order and obtain owner sign-off.
Communications and evidence
Use approved communication channels and need-to-know access. Preserve evidence with timestamps, access records and chain-of-custody procedures appropriate to the organisation. Follow applicable legal, regulatory, contractual and privacy notification requirements with qualified advisers.
Lessons learned
Conduct a blameless review. Identify root causes, control gaps, detection delays and decision bottlenecks. Assign owners and due dates to corrective actions, then test whether improvements work. Exercise scenarios such as ransomware, compromised email and lost administrator credentials.
- Confirm the control has a named owner and documented business purpose.
- Validate configuration against current vendor guidance and organisational policy.
- Test expected and denied access paths; retain evidence of the result.
- Monitor exceptions, failures and configuration changes.
- Review the control after material infrastructure or business changes.
A response plan succeeds when roles are clear, evidence is preserved, containment is deliberate and recovery is tested.