# Incident Response Plan > Create data breach and security incident response plan - Skill: `bromso/incident-response-plan` (Agent Skill) - Install (CLI): `npx skillmds@latest add bromso/incident-response-plan` - Raw SKILL.md: https://api.skillmd.com/api/skills/bromso/incident-response-plan/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: bromso (https://skillmd.com/u/bromso) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/bromso/incident-response-plan --- # Incident Response Plan Create a data breach and security incident response plan for "$ARGUMENTS". Define incident classification, response procedures, notification requirements, communication templates, and post-incident review processes. > **Note:** AI-generated legal content does not constitute legal advice. Consult a qualified attorney. ## Prerequisites Check that `.metapowers/legal/$ARGUMENTS/00-assess.md` exists. If it does not exist, stop and tell the user: > "Run an Assess skill first (e.g. `/legal:risk-assessment $ARGUMENTS`) to generate the prerequisite assessment artifact." If the user passes `--skip-checks`, bypass this check and log the skip to `.metapowers/legal/$ARGUMENTS/skip-log.md` with a timestamp and the reason "Prerequisite check skipped for incident-response-plan". ## Process 1. **Read inputs:** - Read `.metapowers/legal/$ARGUMENTS/00-assess.md` for risk, jurisdiction, and data practice context - Read any existing security or compliance artifacts in `.metapowers/legal/$ARGUMENTS/` for additional context 2. **Define incident types and severity classification:** - **P1 — Critical:** confirmed data breach with sensitive personal data exposed, ransomware with data exfiltration, compromise of authentication systems, regulatory notification thresholds met - **P2 — High:** unauthorized access to systems containing personal data, significant service disruption, suspected data breach under investigation, insider threat confirmed - **P3 — Medium:** attempted unauthorized access (blocked but notable), minor data exposure (non-sensitive, limited scope), malware detection on non-critical systems, policy violations with data implications - **P4 — Low:** phishing attempts (no compromise), minor policy violations, vulnerability discovered (not exploited), suspicious activity under monitoring - Escalation criteria between severity levels 3. **Create detection and identification procedures:** - Technical detection sources (SIEM, IDS/IPS, endpoint detection, DLP, log monitoring) - Human reporting channels (employee reporting, customer complaints, partner notifications, threat intelligence feeds) - Initial triage checklist (what happened, when, what systems/data affected, is it ongoing, initial severity assessment) - Documentation requirements from point of detection 4. **Define incident response team:** - **Incident Commander** — overall coordination, decision authority, stakeholder communication - **Technical Lead** — technical investigation, containment, remediation - **Legal Counsel** — notification obligations, regulatory requirements, privilege considerations, law enforcement liaison - **Communications Lead** — internal and external communications, media handling - **Executive Sponsor** — business decisions, resource authorization, board reporting - Contact information and escalation paths (primary and backup for each role) - External resources (forensics firm, outside counsel, crisis communications, cyber insurance carrier) 5. **Containment procedures:** - **Immediate containment** (first 1-4 hours) — isolate affected systems, preserve evidence, block attack vectors, activate incident response team - **Short-term containment** (4-48 hours) — implement temporary fixes, enhanced monitoring, assess scope - **Long-term containment** — system rebuilds, credential resets, architecture changes - Decision framework for system shutdown vs. monitored containment - Evidence preservation requirements during containment 6. **Investigation steps:** - Root cause analysis methodology - Scope determination (what data, how many records, which individuals, geographic scope) - Affected data and individual identification - Attack vector and timeline reconstruction - Forensic evidence collection and chain of custody - Engagement criteria for external forensics 7. **Notification requirements by jurisdiction:** - **GDPR (EU):** 72 hours to supervisory authority (Article 33), without undue delay to individuals when high risk (Article 34) - **US state breach notification laws:** varies 30-90 days depending on state (document requirements for each applicable state) - **Sector-specific:** HIPAA — 60 days to HHS, individuals, and media (if 500+ affected); GLBA — 36 hours to primary federal regulator; PCI DSS — immediate to acquiring bank and card brands - **Other jurisdictions:** document notification requirements based on assessment context - Notification content requirements per jurisdiction - Attorney General notification requirements - Credit monitoring obligations 8. **Draft communication templates:** - **Regulatory notification** — nature of breach, categories and approximate number of data subjects, DPO contact, likely consequences, measures taken - **Affected individual notice** — plain language description, data involved, steps taken, recommended protective actions, contact information for questions - **Media statement** — brief factual statement, commitment to transparency, contact for inquiries - **Internal communication** — employee notification, management briefing, board notification - **Customer FAQ** — anticipated questions and approved responses - Version control and approval workflow for all communications 9. **Evidence preservation procedures:** - System logs and their retention - Forensic image requirements - Chain of custody documentation - Legal hold procedures - Attorney-client privilege considerations for investigation materials 10. **Post-incident review process:** - Lessons learned meeting (within 1-2 weeks of incident closure) - Root cause analysis documentation - Control improvement recommendations - Policy and procedure updates - Training needs identified - Metrics tracking (detection time, containment time, notification time, total resolution time) 11. **Tabletop exercise plan:** - Exercise scenarios (one per incident type/severity) - Participant roles and preparation - Exercise facilitation guide - Evaluation criteria - Recommended frequency (at minimum annually, quarterly for high-risk organizations) - Documentation and improvement tracking 12. **Write the artifact** to `.metapowers/legal/$ARGUMENTS/03-comply.md` with frontmatter: ``` --- description: Incident response plan for $ARGUMENTS --- ``` Include sections: - **Incident Classification** — types and severity levels (P1-P4) - **Detection and Identification** — sources, channels, and triage procedures - **Incident Response Team** — roles, contacts, and escalation paths - **Containment Procedures** — immediate, short-term, and long-term actions - **Investigation Framework** — root cause, scope, and forensics - **Notification Requirements** — jurisdiction-by-jurisdiction obligations and timelines - **Communication Templates** — regulatory, individual, media, and internal templates - **Evidence Preservation** — collection, custody, and legal hold procedures - **Post-Incident Review** — lessons learned and improvement process - **Tabletop Exercise Plan** — scenarios, facilitation, and schedule - **Compliance Gaps** — identified gaps with remediation recommendations ## Output The incident response plan written to `.metapowers/legal/$ARGUMENTS/03-comply.md`. Present a summary to the user highlighting: - Incident severity classification (P1-P4) defined - Incident response team roles identified - Notification requirements by jurisdiction with timelines - Communication templates drafted - Tabletop exercise plan and recommended frequency - Critical gaps in current incident preparedness