Cybrary ForgeCYBRARY / FORGE
Back to Cybrary Forge

Breach response plan

The same eight steps as the playbook, written the way an organization keeps them: a clock, an owner, the tools that get opened, what is handed on, and the call that gets made. Back to the defender playbook · practice it in the training room.

The plan, step by step

  1. 01

    Watch the wire against the baseline

    detect
    Standing, before anything happens
    by standing

    A breach shows up as traffic the estate has never carried before.

    Owner
    soc analyst
    In the room
    network engineer
    Tools
    SIEM saved searches · NDR or flow collector · Asset inventory · Baseline record
    Handed on
    A dated baseline and a drift figure anyone can re-run.
  2. 02

    Confirm it on the packet timeline

    verify
    First 30 minutes
    by 30 min

    Drift can be a busy afternoon; the timeline names the account.

    Owner
    soc analyst
    In the room
    incident commander
    Tools
    Packet timeline · EDR process tree · Directory audit log · Ticket system
    Handed on
    A written statement: this account, from this machine, at this timestamp — with the frame or log line quoted.

    Page the incident commander and open the incident channel.

  3. 03

    Isolate the machine the attacker holds

    contain
    First hour
    by 1 h

    Every minute it stays on the network is another machine it can reach.

    Owner
    incident commander
    In the room
    soc analyst, platform owner
    Tools
    EDR network containment · Switch port shutdown · Hypervisor pause · Change record
    Handed on
    A list of contained assets with the time each was cut off.

    Tell the platform owner before the machine goes dark, not after.

  4. 04

    Block the account and the route

    contain
    First hour
    by 2 h

    Isolating one machine does nothing if the credentials still work elsewhere.

    Owner
    network engineer
    In the room
    incident commander
    Tools
    Firewall egress rules · DNS sinkhole · Proxy blocklist · Identity conditional access
    Handed on
    Blocked destinations and disabled credentials, with rule ids.

    Warn the service desk that logins may fail, with the wording to use.

  5. 05

    Preserve the evidence before you clean up

    eradicate
    First 4 hours, before anything is rebuilt
    by 4 h

    The capture is the only record of what actually happened.

    Owner
    forensics
    In the room
    legal and privacy
    Tools
    Disk and memory imaging · Log export with hashes · Evidence register · Case system
    Handed on
    Hashed images and exports, with a signed chain of custody.

    Legal decides whether outside counsel and a retained responder are engaged — make the call now, not at day three.

  6. 06

    Close the way in

    eradicate
    Day 1 to day 3
    by 1 d

    Containment without a fix just moves the next run a few minutes later.

    Owner
    identity admin
    In the room
    platform owner, forensics
    Tools
    Credential and key rotation · Golden-image rebuild · Persistence sweep across the estate · Patch and configuration management
    Handed on
    Every implanted foothold named, and the rotation record for every exposed secret.

    Agree the maintenance window with the business owner in writing.

  7. 07

    Restore the baseline

    recover
    Day 2 onward, once eradication is proven
    by 2 d

    The estate is only recovered when its traffic looks like itself again.

    Owner
    platform owner
    In the room
    incident commander, soc analyst
    Tools
    Backup restore from a clean recovery point · Integrity checks · Heightened monitoring
    Handed on
    Services back with the recovery point named, and monitoring turned up on them.

    Tell the business which services are live and what is still degraded.

  8. 08

    Write it up

    report
    Within the regulator's clock, and a debrief inside two weeks
    by 3 d

    The run is worth nothing to the next team if nobody can read it.

    Owner
    legal and privacy
    In the room
    incident commander, communications, executive sponsor
    Tools
    Incident report template · Regulator portal · Customer notice · Lessons log
    Handed on
    The filed notification, the customer notice and a dated list of fixes with owners.

    Notify the regulator, insurer and affected customers as the regime requires.

Clocks that start outside the room

These start on awareness or confirmation, not on containment — which is why confirming the breach is the step everything else hangs off. Check the wording for your own jurisdiction and sector before you rely on any of it.

  • GDPR (EU/UK)
    72 hours

    Tell: Supervisory authority, then affected people when the risk is high. Clock starts on: Becoming aware of a personal data breach.

    Read the source
  • CIRCIA (US critical infrastructure)
    72 hours for a covered incident, 24 hours for a ransom payment

    Tell: CISA. Clock starts on: Reasonable belief a covered cyber incident has occurred.

    Read the source
  • SEC disclosure (US listed companies)
    4 business days

    Tell: Investors, via an 8-K filing. Clock starts on: Determining the incident is material.

    Read the source
  • NIS2 (EU essential and important entities)
    24-hour early warning, 72-hour notification, 1-month final report

    Tell: National CSIRT or competent authority. Clock starts on: Becoming aware of a significant incident.

    Read the source
  • PCI DSS (card data)
    Immediately on suspicion

    Tell: Acquirer and the card brands. Clock starts on: Suspected compromise of cardholder data.

    Read the source