# Incident Response

> Security incident detection, classification, response procedures, and post-incident review following NIST and ISO 27001

- Skill: `hack23/incident-response-3` (Agent Skill)
- Install (CLI): `npx skillmds@latest add hack23/incident-response-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hack23/incident-response-3/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: Hack23 (https://skillmd.com/u/hack23)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/hack23/incident-response-3

---


# Incident Response Skill


## 🔴 AI FIRST Quality Principle

> **Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.**

## Purpose
Defines security incident response procedures following NIST SP 800-61 and ISO 27001 Annex A.16.

## Incident Classification
| Severity | Description | Response Time |
|----------|-------------|---------------|
| Critical | Data breach, system compromise | Immediate (< 1 hour) |
| High | Active exploitation, service outage | < 4 hours |
| Medium | Vulnerability detected, policy violation | < 24 hours |
| Low | Minor security event, informational | < 72 hours |

## Response Phases (NIST)
1. **Preparation** — Tools, procedures, team readiness
2. **Detection & Analysis** — Identify, classify, document
3. **Containment** — Short-term and long-term containment
4. **Eradication** — Remove threat, patch vulnerabilities
5. **Recovery** — Restore systems, verify functionality
6. **Post-Incident** — Lessons learned, process improvement

## For Static Sites (GitHub Pages)
- Monitor Dependabot alerts
- Respond to CodeQL findings
- Review secret scanning alerts
- Patch vulnerable dependencies
- Update security headers

## Communication Requirements
- Notify stakeholders per severity level
- Document timeline and actions taken
- Preserve evidence for analysis
- Update SECURITY.md if needed

## ISO 27001 Mapping
- A.5.24 — Information security incident management planning
- A.5.25 — Assessment and decision on events
- A.5.26 — Response to incidents
- A.5.27 — Learning from incidents

## Related Policies
- [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)