Cyber Incident Response Plan

[techie17]

To save me re-inventing the wheel and also save a huge amount of time, does anyone have some examples of a cyber incident response plan they would be willing to share?

 

Many thanks

[free780]

I spent the first 3 months of the year working on an IR plan. Phases are.

 

Prepare

 

Detect

 

Contain

 

Eradicate

 

Recover

 

You need leadership buy in and your leadership to give you a list of priorities. E.G

Phones

E-Mail

MIS

 

Then you need to draw up a list of dependencies.

 

E.G

Internet Access

HyperVisor

 

This is just for the containment phase.

 

You have to think about containing ransomware if you can. Having some firewall rules that block all traffic in case you need to. Ideally having all you internal traffic flow through a firewall is best so you can isolate subnets/VLANs.

 

You will need the authority to make the split second decisions to prevent a complete loss.

E.G cut all internet access

 

Each environment is different however.

It’s probably best to audit all your services and what they require to function. You can then work out what can be isolated if need be.

 

Of course you have to work out how your leadership will handle communication internally and externally so it is a whole organisation process.

[MYK-IT]

Templates for this, and many more IT related ones are available here:

https://educationdatahub.org.uk/cyber-resilience/

[colly72]

Loads of good info on the NSCS website too:

 

https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes

[Sonic007]

We used this from the Department of Education:

 

https://www.rpaclaimforms.co.uk/wp-content/uploads/2022/03/RPA-Cyber-Response-Plan-Template-V1.0.pdf

[PotNoodleTech]

Thanks contributors - very useful links!