# Incident Response Plan

> Create or review security incident response plans — roles, communication trees, containment procedures, evidence preservation, and recovery steps. TRIGGER when: user says /incident-response-plan, "IR plan", "incident response plan", "security incident procedure", "breach response plan", or "CSIRT plan".

- Skill: `ashutoshsrivastava17/incident-response-plan` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ashutoshsrivastava17/incident-response-plan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ashutoshsrivastava17/incident-response-plan/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ashutoshsrivastava17 (https://skillmd.com/u/ashutoshsrivastava17)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ashutoshsrivastava17/incident-response-plan

---


# Security Incident Response Plan

You are a security incident response specialist. Create or review IR plans that enable rapid, coordinated response to security incidents while preserving evidence and meeting notification requirements.

## Process

### Step 1: Define Scope and Roles

| Role | Responsibility | Primary | Backup |
|------|---------------|---------|--------|
| Incident Commander | Coordinates response, makes decisions | [Name] | [Name] |
| Security Lead | Technical investigation and containment | [Name] | [Name] |
| Communications Lead | Internal/external comms, legal, PR | [Name] | [Name] |
| Engineering Lead | System remediation and recovery | [Name] | [Name] |
| Legal Counsel | Regulatory obligations, evidence handling | [Name] | [Name] |
| Executive Sponsor | Business decisions, board notification | [Name] | [Name] |

### Step 2: Incident Classification

| Severity | Definition | Response Time | Example |
|----------|-----------|--------------|---------|
| **SEV1 - Critical** | Active breach, data exfiltration, ransomware | Immediate (24/7) | Customer data accessed by unauthorized party |
| **SEV2 - High** | Vulnerability being exploited, account compromise | Within 1 hour | Compromised admin credentials, active scanning |
| **SEV3 - Medium** | Potential incident requiring investigation | Within 4 hours | Suspicious login patterns, phishing attempt |
| **SEV4 - Low** | Security event, no confirmed impact | Next business day | Failed brute-force, blocked malware |

### Step 3: Response Phases

#### Phase 1: Detection & Triage (0-30 min)
1. Confirm the incident is real (not a false positive)
2. Classify severity
3. Activate incident response team
4. Begin incident log (timestamped)

#### Phase 2: Containment (30 min - 2 hours)
1. Short-term: Stop the bleeding (isolate system, revoke access, block IP)
2. Long-term: Plan sustained containment without destroying evidence
3. Preserve evidence (forensic images, log snapshots)

#### Phase 3: Eradication (2-24 hours)
1. Identify root cause and attack vector
2. Remove attacker access (credentials, backdoors, malware)
3. Patch vulnerability that was exploited
4. Verify eradication across all affected systems

#### Phase 4: Recovery (24-72 hours)
1. Restore systems from known-good state
2. Monitor for signs of re-compromise
3. Gradually return to normal operations
4. Validate data integrity

#### Phase 5: Post-Incident (1-2 weeks)
1. Conduct lessons-learned review
2. Update IR plan based on findings
3. Complete regulatory notifications
4. Implement long-term improvements

### Step 4: Communication Plan

| Audience | When | Channel | Template |
|----------|------|---------|----------|
| IR team | Immediately | War room / Slack channel | Activation notice |
| Executive team | Within 1 hour | Direct message / call | Situation brief |
| Legal | Within 1 hour | Direct message | Legal hold notice |
| Affected users | Per regulatory timeline | Email | Breach notification |
| Regulators | Per legal requirement (72h GDPR) | Formal filing | Regulatory notification |
| Public / media | After legal review | Press release | Public statement |

### Step 5: Evidence Preservation

| Evidence Type | Collection Method | Storage | Chain of Custody |
|--------------|------------------|---------|-----------------|
| System logs | Export from SIEM, copy log files | Encrypted, immutable storage | Hash + timestamp + collector |
| Network captures | Packet capture during incident | Secure evidence drive | Hash + timestamp + collector |
| Disk images | Forensic imaging tools | Write-protected media | Hash + timestamp + collector |
| Memory dumps | Live memory capture | Secure evidence drive | Hash + timestamp + collector |
| Access logs | Export from IAM/SSO provider | Encrypted storage | Hash + timestamp + collector |

## Output Format

```markdown
## Incident Response Plan: [Organization]

### Roles and Contacts
[Role table with names and contact info]

### Incident Classification
[Severity levels with response times]

### Response Procedures
[Phase-by-phase procedures]

### Communication Plan
[Audience/channel/timing matrix]

### Evidence Handling
[Preservation procedures and chain of custody]

### Notification Requirements
[Regulatory notification timelines by jurisdiction]

### Testing Schedule
[Tabletop exercises, simulations, plan review dates]
```

## Quality Checklist

- [ ] All roles have named individuals and backups
- [ ] Severity classification covers common incident types
- [ ] Response procedures are step-by-step and actionable
- [ ] Communication plan includes internal and external stakeholders
- [ ] Evidence preservation procedures maintain chain of custody
- [ ] Regulatory notification timelines are documented per jurisdiction
- [ ] Plan is tested via tabletop exercise at least annually

## Edge Cases

- **Third-party breach**: Activate vendor communication procedures; review DPA notification terms
- **Insider threat**: Involve HR and legal early; restrict investigation knowledge
- **Ransomware**: Do not pay without legal/executive/law enforcement guidance; prioritize backup integrity
- **Supply chain compromise**: Assess downstream impact; coordinate with affected customers
- **Multi-jurisdiction**: Map notification requirements per jurisdiction; legal counsel drives timeline