Incident Response SOPs/Policies

N_Bakewell — Mon, 09 Oct 2023 09:31:22 GMT

Good morning,

I am in the process of reviewing/editing/consolidating my organization's set of SOPs and policy documents regarding incident response. These include DR-BCP, incident response framework, roles and responsibilities, etc.. All in all, we have 7-8 documents all surrounding cyber incident response, with a lot of double dipping. I believe this creates confusion, not to mention version control issues. So I was wondering - in your organizations, how many separate documents do you have that deal with cyber incident response?

Re: Incident Response SOPs/Policies

emb021 — Wed, 13 May 2020 17:38:53 GMT

I work with a lot of orgs and review their policies and documentation.

What I typically see:

A BC/DR Policy document

A CSIR Policy document

A BIA document listing critical applications and their owner, RTO, RPO, etc

A BC/DR plan document (larger orgs will have this as 2 separate plans), which gives the details on how these are done.

A CSIR plan document. Some groups will have a 'run book' or 'play book' with details on how to handle different specific incidents (DDOS attack, malware, ransomware, etc)

Ideally, orgs should do a run thru of their BC plan, DR plan and CSIR plan on at least an annual basis. I am really impressed when orgs do this more then once a year, but that seems rare.

topic Incident Response SOPs/Policies in Tech Talk

Incident Response SOPs/Policies

Re: Incident Response SOPs/Policies