Incident readiness
Being ready is measurable: whether the on-call engineer can find the log, whether the playbook matches the platform you actually run, and whether decision authority is clear at 03:00.
Updated
Components
- IR plan review against NIST SP 800-61 Rev. 3 and the organisation’s actual regulatory and contractual reporting clocks.
- Playbooks for the scenarios that actually happen: identity compromise, token theft, ransomware precursors, cloud key exposure, data exfiltration and AI system abuse.
- Detection coverage review: which of these scenarios your current logging would actually surface, who has access to the evidence and whether it is retained long enough to investigate.
- Tabletop exercise with the real decision-makers, ending in a concrete gap list with owners, due dates and retest conditions.
1Prepare
- Playbooks
- Access
- Authority
- Exercises
2Detect and analyse
- Alerting
- Triage
- Scope determination
3Contain and eradicate
- Token revocation
- Isolation
- Credential reset
- Persistence removal
4Recover and learn
- Service restoration
- Regulatory reporting
- Control change
The exercise tests triage and authority, technical access to logs and containment controls, communication and reporting decisions, recovery priorities and the evidence needed to close the follow-up actions. A playbook is not treated as fixed until the responsible people can use it against the platforms they actually run.
Frequently asked questions
Technical or management exercise?
Both are offered. Management tabletops surface authority and communication gaps; technical exercises surface tooling and access gaps.
Related
Incident response
IR lifecycle aligned to NIST SP 800-61r3 and CSF 2.0, cloud and identity playbooks, detection coverage and post-incident learning that changes controls.
Incident response checklist
Printable IR readiness checklist aligned to NIST SP 800-61r3: authority, playbooks, evidence access, communications and regulatory clocks.
Microsoft Sentinel
Using Microsoft Sentinel for detection engineering: data source selection, analytics rules, ATT&CK coverage, the data lake tier and automation.
IR playbooks that work
A playbook structure built for 03:00 use: decision points, containment options with trade-offs, evidence steps and the exact notification clocks under DORA, NIS2 and GDPR.
Tabletop exercises
How to design and facilitate a security tabletop that surfaces decision gaps instead of confirming that everyone has read the policy, and how it fits DORA/NIS2 testing obligations.
Military service
Service 2019–2022 in the Cryptology and Cyber Space Corps as a certified instructor: discipline, OPSEC and structured decision making.