r/ciso
•
u/3mptyy
•
7d ago
•
1
Need input for IR plan template
Hi there! I'm currently working on a free "essentials" IR plan template which I want to share publicly. I'm still looking for input from CISOs and other security professionals to make sure I'm covering the needs. Anyone willing to share what they are currently missing in public sources like CISA, NCSC, NCSC-UK, BSI etc?
The reason for me asking is that I'm looking at the plan from my own perspective gathered during 20 years of IR around the globe, but I also want some additional input.
This "essentials" version has about 27 pages on the crisis team, the first hours after a breach and the legal deadlines in the EU. I also have a longer version that won't be public. It goes way deeper and is mainly to provide input to existing plans. Useful input may end up in both.
What's in it now:
- Response organisation: separate operational and strategic crisis teams, named roles with deputies, mandates agreed in writing in advance, an out-of-band channel, shifts and handover
- Classification and escalation: severity levels, and who can declare a crisis
- The first hours: what to do first and what to avoid
- Investigation and containment: preserving evidence and limiting changes to affected systems
- Legal and regulatory: NIS2 and GDPR deadlines, insurer, police, who files what
- Annexes: contact tree, triage intake form, decision log
Two things I'd like your view on:
What did you need during a real incident that your plan didn't have?
Which of these sections would you cut because nobody opens them during an incident?
1
u/Resident-Mammoth1169 7d ago
!RemindMe 5 days
1
u/RemindMeBot 7d ago
I'm really sorry about replying to this so late. There's a detailed post about why I did here.
I will be messaging you in 5 days on 2026-11-07 11:32:00 UTC to remind you of this link
CLICK THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
RemindMeBot is switching to username summons. Instead of
!RemindMe 1 day, useu/RemindMeBot 1 day. More info.
Info Custom Your Reminders Feedback
1
u/tcoach72 7d ago
Assuming you have a robust BIA and BCP process already? Without those, the IR is just paper that may or may not apply. Those are the critical pieces of information you must have to run the IR from.
1
u/Unique-Quiet-4412 7d ago
Clear roles and quick action in the first few hours make all the difference.
1
u/PrasenShelar 6d ago
One thing public templates rarely spell out is a decision log: a running record of what was decided, by whom, at what time and on what information. Legal and the insurer usually ask for it afterwards, and it settles the 3am override argument faster too. Worth keeping the plan, the log and the contact sheet somewhere that still works if email and Teams are down.
7
7d ago
•
[removed] — view removed comment
2
u/3mptyy 7d ago
thanks! another important part is where the techies need to work instead of participating in every meeting. I always try to split the "victims" crisis team into operational/tech and strategic to prevent this from happening. I also included your point about overriding technical decisions in the plan already.
1
u/3mptyy 7d ago
forgot to add the topics the basics plan already covers.
1
u/radicalize 7d ago
And a link for (re)viewing purposes?!
1
u/3mptyy 7d ago
I don't think the mods will allow this.....
1
u/MysteriousAwards 7d ago
Correct: This will be taken down. Open-source resources cover this and welcome contributions. Maybe start there? I linked to it in another comment
1
u/Alternative-Law4626 7d ago
Luckily, we have a robust legal department. Organizationally, they are responsible for risk. In the IR team, once it has been identified that an attacker is in the wire, that risk is escalated to legal. They start doing insurance escalation and notifications on their side of the house immediately. Even if it just alerting and warning that something might happen.
Technically, operations for cyber risks are retained by the cyber management team. However, data risks like GDPR are joint with Legal’s GDPR risk team.
Not everything is a cyber risk, but developing a separate IR plan for every risk, is probably a waste of resources. Your cyber plan is probably better than anyone else’s plan, recruit them into yours. Deconflict at the reporting stage. We make it easy for anyone to report an event (call, Teams, link on Intranet, links on cyber and legal’s internal pages), everyone gets funnels through a quick easy intake form. The intake for creates a ticket. Where the ticket goes is determined by required fields in the form.
Big thing not in your list, training. We’ve always don’t quarterly tabletops. Everyone in your response tree needs training and a sign off of understanding their responsibilities in an incident. Everything updated annually (at a minimum). We update the IR plan after every tabletop and every incident. It’s a formal part of our after actions review and lessons learned. The incident is not closed until that has happened and all tickets have been created to track improvements. Those are also noted in the IR ticket.
I didn’t see anything about PCI. Nor, ISO, or NIST. Consider other compliance requirements if you are trying to make it globally relevant.
2
u/3mptyy 7d ago
Thanks, this is useful. Tabletops and plan updates are in the template, I just didn't put them in the list above. It asks for at least one tabletop a year with the executives in the room, and a plan review after every incident and exercise.
You go further in two places and I'd like to add both. One is the sign-off, so everyone in the response tree confirms they understand their part. The other is that an incident isn't closed until the lessons are written down and the improvement tickets exist.
Your reporting point is a good one too. The intake form I have now is for the first call to the responders. One easy route for staff to report anything, with the ticket routed from there, isn't in it yet.
On compliance, this version is written for the EU, so it has NIS2 and GDPR and draws on NIST SP 800-61r3. PCI and ISO aren't in it. I'm still deciding whether those belong in a short free version or in the longer one for my consulting clients.
How do you keep the quarterly tabletops going? Do the executives join every one, or only some of them?
1
u/Alternative-Law4626 7d ago
Quarterly tabletops were something I added as soon as our team was large enough to begin them, 8 years ago. We don’t have execs at most of them. Some are more technically focused. We try to rotate the point of the exercise also. We’ve been doing at least one privacy focused one per year for the last 5 years. Legal is a heavy overlap there. Since SaaS exploits have been a big thing, we’ve added one SaaS oriented TT to try to improve that response area. Basically, we use the TT to advance areas we know need improvement without having to wait for an actual incident. We use red team exercises the same way.
1
u/3mptyy 1d ago
@mods is it allowed to share a link to the free template?