What I Kept And What I Deleted From A Cyber Security Incident Response Plan Template

Downloaded three of these last year because a client's insurer asked for one. Every template i found was written for a company with a security team in it. There is a page for the incident commander, a page for the communications lead, a page for the legal representative and an escalation matrix with four tiers. i am one person with a laptop. Filling that in truthfully would have produced a document that was mostly the word me, and an insurer reading it would have learned nothing at all.

What i ended up with is two pages, and it is the parts of the template that survived contact with a real incident. A contact list that includes the host's emergency number, whoever owns the registrar login, whoever controls dns and the client's own out of hours number, stored somewhere that does not depend on the site or the office email being up. A fixed order of operations for the two things that really happen to sites like these, which are injected spam or a defacement, and a total outage, written as steps rather than as principles. A short section on what i am allowed to do without asking, because the hour you spend waiting for permission to take a site offline is the hour google spends indexing the pharmacy pages. A line about evidence, meaning take a copy before you clean, which i ignored twice and regretted both times. And a communication rule, which is really a promise of an update at a fixed interval even when there is nothing new to say, because silence is what makes a client ring you every ten minutes.

The parts i deleted were the tiers, the roles, the legal escalation path and the whole section on regulatory notification, which for the sites i look after is one sentence pointing at whoever the client's data protection contact is rather than a process i am going to own. i deleted every instance of the word stakeholder as well. The thing no template has, and the reason most of them are useless, is a section on where the plan lives and who can open it while the incident is happening. Mine is printed, one copy in the bag and one in a drawer at home, plus an offline copy on a phone. A plan sitting in a shared drive behind the login you have just lost is a plan you do not have, and every template i read buried that under the org chart.