Incident response readiness checklist
Readiness is measured before the incident. Work through this with the people who would actually be paged.
Updated
Authority and roles
- Incident commander role defined with a deputy.
- Containment authority pre-delegated (account disable, token revoke, isolate host).
- Escalation criteria written and known.
- Out-of-hours contact path tested in the last quarter.
Playbooks
- Identity compromise and token theft.
- Ransomware precursor activity.
- Cloud credential or key exposure.
- Data exfiltration through SaaS.
- AI system abuse, prompt-injection or agent-misuse incident.
- Each playbook names exact queries, consoles and actions.
Evidence
- Responders have standing read access to the SIEM and cloud consoles.
- Log retention meets investigative need.
- Evidence preservation steps documented for cloud resources.
- Forensic support contacts identified in advance.
- Response plan maps its activities against NIST SP 800-61r3's CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) rather than the retired 2012 four-phase model.
Communication and reporting
- Regulatory clocks documented: DORA (4h/72h/1-month), NIS2 (24h/72h/1-month) and GDPR (72-hour breach notification to the supervisory authority) as applicable.
- Legal and communications contacts on the call tree.
- Customer notification templates drafted.
- Post-incident review process ends in a control change.
Related
Incident readiness
Incident response plan review, cloud and identity playbooks, tabletop exercises and detection coverage assessment.
Incident response
IR lifecycle aligned to NIST SP 800-61r3 and CSF 2.0, cloud and identity playbooks, detection coverage and post-incident learning that changes controls.
Microsoft Sentinel
Using Microsoft Sentinel for detection engineering: data source selection, analytics rules, ATT&CK coverage, the data lake tier and automation.
IR playbooks that work
A playbook structure built for 03:00 use: decision points, containment options with trade-offs, evidence steps and the exact notification clocks under DORA, NIS2 and GDPR.
Tabletop facilitation guide
Printable facilitation guide for a 90-minute security tabletop exercise: preparation, injects, decision probes and follow-up.
Tabletop exercises
How to design and facilitate a security tabletop that surfaces decision gaps instead of confirming that everyone has read the policy, and how it fits DORA/NIS2 testing obligations.