Incident Response Management

This document discusses how to assemble and organize an incident response team, how to arm them and keep them focused on containing, investigating, responding to and recovering from security incidents.

Comparing SANS and NIST Incident Response Steps.

This resource from CMU provides an example procedure for how to respond to information security incidents.

This article describes CSIRTs and their role in preventing, detecting, analyzing, and responding to computer security incidents.

This article will discuss how to create a cybersecurity incident response plan for your organization based on NIST guidelines.

This article provides information on the elements and importance of an up-to-date IR Plan.

This article describes why RCA is a necessary step in a company's cybersecurity evolution.

This article examines the importance of post-incident reviews for security teams.

This blog post provides insights from various industry experts on how to tackle a data breach and what happens afterwards.

This article provides a six-step process that can help your incident responders take action faster and more effectively when the alarm goes off.

How to build an incident response plan around the 6 phases of incident response, examples to get you started, and a peek at incident response automation.

A listing of SIEM tools provided by Gartner.

In this article, Kroll provides a high-level view of how to build an IRP and the types of questions you will want to address as you begin planning.

Quick steps you can take now to PROTECT your control system

This NIST Special Publication focuses on providing plans and procedures to facilitate resuming normal business operations as quickly as possible during a cybersecurity event.

NIST resource that defines incident handling requirements from event to incident declaration.

NIST resource that defines incident reporting requirements when reporting within the organization and external agencies.

This NIST Special Publication offers guidance for incident response by identifying best practices and other recommendations.

This guide from NIST discusses how important forensics can be for an organization during a cyber incident.

This article discusses how to conduct incident postmortems, and why they're important.

This article describes how to build and regularly test your IR plan.

This is a policy template from SANS for incident response management.

This whitepaper from SANS provides basic nomenclature and examples for events and incidents.

This SANS whitepaper details procedural incident response steps, supplemented by tips and tricks for use on Windows and UNIX platforms.

This document provides an overview of items that election officials should take into consideration when developing these policies and plans. Additionally, it provides usable checklists and other resources designed to help develop more in-depth procedures for implementing cyber incident response policies and procedures.

US-CERT resource that provides information on how to create, test and improve an Incident Management plan.