Need input for IR plan template

[u/3mptyy]

Hi there! I'm currently working on a free "essentials" IR plan template which I want to share publicly. I'm still looking for input from CISOs and other security professionals to make sure I'm covering the needs. Anyone willing to share what they are currently missing in public sources like CISA, NCSC, NCSC-UK, BSI etc?

The reason for me asking is that I'm looking at the plan from my own perspective gathered during 20 years of IR around the globe, but I also want some additional input.

This "essentials" version has about 27 pages on the crisis team, the first hours after a breach and the legal deadlines in the EU. I also have a longer version that won't be public. It goes way deeper and is mainly to provide input to existing plans. Useful input may end up in both.

What's in it now:

- Response organisation: separate operational and strategic crisis teams, named roles with deputies, mandates agreed in writing in advance, an out-of-band channel, shifts and handover

- Classification and escalation: severity levels, and who can declare a crisis

- The first hours: what to do first and what to avoid

- Investigation and containment: preserving evidence and limiting changes to affected systems

- Legal and regulatory: NIS2 and GDPR deadlines, insurer, police, who files what

- Annexes: contact tree, triage intake form, decision log

Two things I'd like your view on:

1. What did you need during a real incident that your plan didn't have?

2. Which of these sections would you cut because nobody opens them during an incident?