Who declares an incident?
Define activation criteria, commander authority, alternates, and severity levels.
Incident response planning
Build an Incident Response Plan Your Team Can Use Under Pressure
Define who leads, which facts matter first, how critical services are protected, and when legal, insurance, forensic, communications, and executive decisions must happen.
CommandNamed authority and alternates
TriageSeverity and activation criteria
CoordinateLegal, insurer, vendor, communications
RecoverPriorities and validated restoration
Incident command
Answer the decision questions before the first urgent call
A useful plan gives responders authority, establishes thresholds, protects evidence, coordinates outside parties, and keeps leadership informed without slowing containment.
What must be preserved?
Identify logs, systems, accounts, legal holds, chain-of-custody needs, and forensic decisions.
Which services recover first?
Align restoration with business impact, dependencies, clean backups, and safe return criteria.
Plan the coordination layer
- Executive and board notification thresholds
- Cyber insurer and breach counsel contacts
- Forensic, cloud, MSP, and vendor access
- Customer, employee, regulator, and law-enforcement decisions
- Out-of-band communications
- After-action ownership and risk updates
First-hour discipline
Give the team a sequence without pretending every incident is identical
| Action | Decision owner | Information needed | Danger to avoid |
|---|---|---|---|
| Validate and classify | Commander and technical lead | Activity, scope, services, confidence | Declaring facts too early |
| Protect evidence | Technical and forensic lead | Logs, volatile data, timestamps | Destroying evidence |
| Contain safely | Commander and service owner | Impact, dependencies, attacker access | Broad shutdown without analysis |
| Notify parties | Executive, legal, privacy, insurer | Policy, contracts, known facts | Late or inconsistent notice |
| Prepare recovery | Recovery leads | Clean restore, credentials, tests | Reintroducing compromise |
Exercise before an emergency
Test decisions, dependencies, and communications
Executive tabletop
Challenge severity, insurer and counsel coordination, communications, funding authority, and board notification.
Technical walkthrough
Confirm logging, isolation, identity recovery, cloud access, backups, evidence, and vendor escalation.
After-action governance
Assign findings, update the plan and risk register, and validate corrective action.
Route the need correctly
Use planning for readiness and active response for a current incident
If you are preparing
Use the free Incident Recovery Readiness Assessment to identify planning gaps.
If an incident may be active
Go directly to Incident Response and Digital Forensics for investigation and containment support.
If corrections need sequencing
Continue to Cybersecurity Program Development and Roadmap to assign owners, dependencies, and milestones.
Ali Hassani, CISO
Incident planning informed by infrastructure, governance, and executive risk
Ali Hassani brings 25+ years of cybersecurity, network, Microsoft infrastructure, IT operations, compliance, and CISO leadership experience to incident readiness. Plans remain grounded in real systems, dependencies, authority, and investigation needs.
Review Ali Hassani's cybersecurity and IT leadership experience
Common questions
What organizations ask before this work begins
Is incident response the same as disaster recovery?
No. Incident response covers investigation, containment, communication, and evidence; disaster recovery restores services and data. They must coordinate.
How often should we run a tabletop?
At least annually is common, plus after material technology, leadership, vendor, threat, or regulatory changes.
Can the vCISO join incident command?
Yes. The engagement can define advisory or leadership roles, escalation thresholds, authority limits, and coordination.
Make critical incident decisions before the pressure arrives
Discuss incident command, escalation, communications, evidence, tabletop exercises, and recovery governance.