4.3.1. IR Planning, Playbooks, and Tabletop Exercises
💡 First Principle: A playbook converts analyst judgment into documented procedure for known threat scenarios — freeing cognitive resources during an incident for the genuinely novel decisions that can't be pre-scripted.
Incident Response Plan
The IR plan defines the overall framework: who is responsible for what, how incidents are classified and escalated, what external parties are notified and when, and how the organization communicates during an incident. It's the governance document that makes ad-hoc IR systematic.
Key IR plan components:
- Roles and responsibilities — IR Team Lead, analysts, legal, PR, executive sponsor, external IR retainer contact
- Incident classification — Severity levels (P1–P4) with criteria and response time expectations
- Communication protocols — Internal (encrypted channel separate from potentially compromised corporate email), external (customers, regulators, law enforcement, media)
- Legal and regulatory triggers — When must you notify regulators (GDPR 72-hour notification; SEC 4-day material incident disclosure)? When do you call law enforcement?
- Escalation paths — Clear criteria for escalating from Tier 1 to Tier 2 to Tier 3 to external IR firm
Playbooks are step-by-step procedures for specific incident types:
| Playbook Type | Key Steps Defined |
|---|---|
| Phishing playbook | Isolate affected user; collect email headers; check other recipients; block sender/domain; reset credentials if clicked |
| Malware/ransomware playbook | Isolate infected system; identify patient zero; check for lateral spread; preserve evidence; begin eradication |
| Data breach playbook | Confirm data access; identify data type and volume; initiate legal hold; begin regulatory notification clock |
| Insider threat playbook | Preserve evidence (covertly if possible); coordinate with HR/legal; restrict access; document chain of custody |
| DDoS playbook | Identify attack type; activate upstream scrubbing; adjust rate limits; notify ISP; communicate status to stakeholders |
Tabletop Exercises walk the IR team through a simulated scenario in a discussion format — no systems are actually affected, but participants must articulate what they would do at each decision point. Benefits:
- Identifies gaps in playbooks (steps that don't work in practice)
- Reveals communication breakdowns (who calls who? when? using what?)
- Tests decision-making authority (who can authorize taking a production system offline?)
- Surfaces resource gaps (do we have enough forensic licenses? IR retainer engaged?)
- No operational risk — run complex scenarios impossible to simulate in live systems
Training — Analysts need both technical training (malware analysis, forensics, tool proficiency) and process training (playbook walkthrough, escalation procedures). Cross-training ensures coverage during vacations or simultaneous incidents.
Business Continuity (BC) and Disaster Recovery (DR) planning intersects with IR: when an incident disables critical systems, BC/DR procedures define how the organization continues operating (manual processes, backup sites, vendor failover) and recovers full functionality. IR focuses on security; BC/DR focuses on operational continuity. Both are needed.
⚠️ Exam Trap: Tabletop exercises and penetration tests serve different purposes. Tabletops test process and communication. Pen tests test technical defenses. Neither substitutes for the other. A common exam trap is presenting a scenario where an organization wants to "test their IR process" — tabletop is the correct answer; pen test tests defenses, not process.
Reflection Question: During a tabletop exercise simulating a ransomware attack, the IR team discovers that the step "notify legal counsel" in the playbook lists a phone number for an attorney who left the firm 18 months ago. What category of preparedness gap does this represent, and what process would prevent it from recurring?
