Build a sample incident response plan

Operational six-phase methodology that prioritizes decision velocity, regulatory timing, and defensible records.

Industry-standard 4-phase incident response framework from NIST Computer Security Incident Handling Guide. Widely adopted across federal agencies, defense contractors, and regulated industries. Includes NIST prioritization matrix.

International 5-phase information security incident management standard from ISO/IEC, aligned with ISO 27001 ISMS programs. Best for ISO 27001-certified organizations, EU/EMEA enterprises, and any environment where alignment with international standards is contractually required. Native integration with ISO 27037 evidence handling.

CISA Federal Government Cybersecurity Incident Response Playbook (Nov 2021, updated 2024) per Executive Order 14028. Mandatory for FCEB agencies, encouraged by CISA for private sector adoption. Aligns with NIST 800-61 Rev. 2 phase model with CISA-specific procedural elements: Major Incident Determination, mandatory CISA notification within 24 hours, MITRE ATT&CK technique enumeration, sector Risk Management Agency coordination, OMB and congressional reporting for Major Incidents, formal After-Action Report submission within 60 days.

SANS PICERL 6-phase incident response model from SEC504 / SEC401 course material. The most widely-taught IR model in practice, often preferred by SANS-trained responders. Phases: Preparation, Identification, Containment (short and long-term), Eradication, Recovery, Lessons Learned. Tightly mapped to MITRE ATT&CK techniques and chain-of-custody preservation patterns from SANS Incident Handler's Handbook.