In the moment of a breach, every minute counts. Organizations that respond well don't improvise — they follow a rehearsed plan.
Incident Response is the difference between a contained incident and a full-blown catastrophe.
The phases of response
Preparation, detection, containment, eradication, recovery and lessons learned — each phase has clear steps. Improvising during a crisis almost always makes things worse.
Hours— the first hours after a breach determine the scale of the damage.
Elements of a good response plan
- Clear roles and responsibilities during an incident
- A definition of what counts as an "incident" and when it is escalated
- Procedures for containment and isolation
- A communication plan (internal and external)
- Regular rehearsals (table-top exercises)
How to protect yourself
A response plan has to be tested before it's needed. Table-top exercises expose the gaps in a calm setting, not in the heat of a real attack.
Need an incident response plan? Get in touch with us.