Incident Response Planning & Playbooks

Problems addressed

• Staff are unsure who decides, who communicates, and who to call when email, a website, or an account is compromised.
• Response steps live in memory or in a file that people do not use.
• Leadership does not have a short checklist for the first hours of an incident.

Potential scope of work

• Review how the organization would respond with the process it has today.
• Define roles, escalation, and internal communication.
• Draft a practical playbook for incidents the organization chooses to cover, such as a compromised account, suspected ransomware, or a public website outage.
• Walk through the playbook in a tabletop discussion and revise it from what that discussion shows.

Example deliverables

• Incident response playbook
• Role and escalation list
• First-hours checklist
• Tabletop discussion outline, plus revisions that come out of the discussion

Relevant capabilities

• Secure

Build, Enable, and Secure are the firm’s capability names. A procurement scope can use one or more of them.

Outside this service

• Does not include continuous monitoring, a guaranteed emergency retainer, or certified digital forensics.
• Does not replace the organization’s legal, law-enforcement, or insurance obligations.

Supporting documentation

• Capability Statement

  Two-page capability statement for Guided Velocity, the public-facing brand of Eastern Provisions LLC. It covers services, delivery approach, the principal’s background, and business identifiers.

  PreviewDownload PDF