Incident Response Runbook phases

Incident Response (IR) Runbooks are divided into different phases. Each phase highlights the response teams that should be involved, the actions that you and the IR team should take, and communication strategies.

Runbooks contain these phases:
  1. Education, Preparation, and Prevention — Information about the cyberattack and the actions you should take to prepare for a cyberattack.
  2. Detection & Identification — Indicators that a cyberattack occurred.
  3. Containment & Initial Investigation — Actions to safely contain the cyberattack.
  4. Eradication & Remediation — Actions to remove the threats from your network and remediate any underlying issues.
  5. Recovery & Restoration — Actions to recover lost data and restore systems to normal.
  6. Forensic Investigation — An overview of the investigation that the IR team performs.
  7. Reporting & Lessons Learned — An overview of the final analysis of the incident.