Writing incident response playbooks teams actually use
A playbook that reads like a policy will not be opened during an incident. The ones that get used are short, decision-shaped, and honest about the cost of each containment option.
By Piotr Zenon Żabrowski · Published · Updated
1Prepare
- Playbooks
- Access
- Authority
- Exercises
2Detect and analyse
- Alerting
- Triage
- Scope determination
3Contain and eradicate
- Token revocation
- Isolation
- Credential reset
- Persistence removal
4Recover and learn
- Service restoration
- Regulatory reporting
- Control change
The structure
01Trigger and scope
The specific signals that open this playbook, and explicitly what it does not cover.
02First ten minutes
Named actions with the exact console or command path, and who is allowed to take them without approval.
03Containment options with cost
Each option lists what it stops, what it breaks, and what evidence it destroys.
04Evidence preservation
Snapshot, token and log capture steps taken before containment, because containment often deletes the answer.
05Decision points
Escalate, notify, involve legal, engage the provider — each with a named role, not a team name.
06Notification clocks
DORA's 4-hour initial notification from classification (24-hour ceiling from detection), NIS2's 24-hour early warning, GDPR's 72 hours from awareness — each started from its own trigger, classified once.
07Recovery and verification
How you prove the intruder is out, including credential and token invalidation.
The playbook set worth having first
| Playbook | First containment decision |
|---|---|
| Business email compromise | Revoke sessions and tokens before resetting the password |
| Ransomware in the estate | Isolate segments and protect backup credentials before wiping anything |
| Cloud identity compromise | Kill refresh tokens, then review role assignments created during the window |
| Public cloud data exposure | Close access and preserve access logs before rotating keys |
| Insider data exfiltration | Involve HR and legal before touching the account |
| AI system abuse or data leakage | Disable the tool integration, keep prompt and retrieval logs |
Playbook quality test
- A competent engineer who has never seen it can execute it at 03:00.
- Every containment option states what it breaks.
- Evidence steps come before destructive steps.
- Named roles, not team names, own each decision.
- Notification clocks, their trigger event and their deadline are stated per applicable regime.
- It was exercised in the last twelve months and updated afterwards.
Frequently asked questions
How many playbooks are enough?
Six well-exercised ones beat thirty unread. Cover the scenarios that actually occur, then add depth.
Who should write them?
The people who would run the incident, reviewed by the engineers who own the affected systems. Externally written playbooks fail on environment detail.
Do DORA and NIS2 share the same notification clock?
No, and the clocks start at different points. Under DORA, the classification decision starts a 4-hour clock for the initial notification, with a 24-hour hard ceiling from detection, then 72 hours for the intermediate report and one month for the final report. Under Poland's NIS2 transposition (the amended KSC Act), the early warning to the competent CSIRT is due within 24 hours of detection, the full notification within 72 hours, and the final report within one month. GDPR's 72 hours runs from awareness of a personal-data breach, which is a different trigger again. One classification event should start all applicable clocks simultaneously, each routed to its own deadline.
Related
Incident response
IR lifecycle aligned to NIST SP 800-61r3 and CSF 2.0, cloud and identity playbooks, detection coverage and post-incident learning that changes controls.
Incident readiness
Incident response plan review, cloud and identity playbooks, tabletop exercises and detection coverage assessment.
Tabletop exercises
How to design and facilitate a security tabletop that surfaces decision gaps instead of confirming that everyone has read the policy, and how it fits DORA/NIS2 testing obligations.
Incident response checklist
Printable IR readiness checklist aligned to NIST SP 800-61r3: authority, playbooks, evidence access, communications and regulatory clocks.
From CSPM alerts to fixes
A CSPM tool produces thousands of findings. This is the triage and ownership model that converts that backlog into a small number of changes that matter.
Multi-cloud baseline
How to express a single set of security requirements — including AI workload guardrails — across Azure, Google Cloud and Alibaba Cloud without maintaining three unrelated standards.