Most organizations can produce an incident response plan. Fewer can show that the people named in it can do what it says when email is down, the on-call lead is unreachable and a business owner is asking whether to switch off a revenue system. Readiness is the ability to make and carry out decisions in the first hours without improvising the basics. The document is an input to that ability, not proof of it.
NIST’s revised incident response guidance, SP 800-61 Rev. 3, is written as a Cybersecurity Framework 2.0 community profile. It places incident response inside cybersecurity risk management rather than treating it as a separate IT procedure. That framing fits what readiness work looks like in practice: much of it happens well before detection, in authority, access, logging and recovery design.
Nine checks
Score each check from observed behavior, not from what the plan says. Pass means it was demonstrated in a test. Partial means documented but untested. Fail means neither.
| Check | What passing looks like | Where teams usually fail |
|---|---|---|
| 1. Declaring an incident | A named role can declare an incident at any hour without committee approval. The criteria are short enough to apply under stress. | Declaration waits for certainty, or for a senior person to be reachable. |
| 2. Out-of-band communication | Responders have a channel that works when email, chat and the identity provider are down or untrusted. Everyone named has joined it and used it. CISA’s guidance also advises out-of-band communication so the attacker is not alerted. | The channel is documented but never tested, or it sits on the tenant that is compromised. |
| 3. Pre-authorized containment | Responders know which actions they can take without asking, such as isolating a host, disabling an account or blocking egress, and which need a business decision. | Every containment step needs a change ticket, so analysts hesitate or wait. |
| 4. Access that survives the incident | Responder and break-glass accounts exist outside the directory or identity provider that may be compromised, and access has been tested. | The recovery team’s administrative access depends on the same directory that is being rebuilt. |
| 5. Evidence preservation | Responders know what to capture before containment, such as memory, disk images and logs, and who holds the tooling. Log retention covers the period you would expect to investigate. | Hosts are reimaged first and logs have rolled over by the time anyone asks for them. |
| 6. External parties | Counsel, an incident response provider, insurer notification terms and law enforcement contacts are reachable, contracts are in force, and it is clear who calls whom. | Contacts are found during the incident, and insurance terms are read afterward. |
| 7. Priority knowledge | Responders can name which systems carry which business processes and the agreed order of restoration. | Priority is decided live by whoever is loudest. |
| 8. Recovery inputs | Backups are offline or immutable, and restores have been tested. CISA’s response checklist directs recovery from offline, encrypted backups. | Backups are reachable with domain credentials, and no one has timed a restore. |
| 9. Decision log and clocks | Someone keeps a time-stamped decision record, and the team knows which notification clocks apply. | Decisions are reconstructed from memory days later. |
On notification clocks: for a company subject to the SEC’s rules, Form 8-K Item 1.05 is due four business days after the company determines an incident is material, and the company must make that determination without unreasonable delay after discovery. Other regulators and contracts set their own clocks. Identify yours before an incident, with legal counsel, rather than during one.
Three drills that fit in an hour
A tabletop tests discussion. These drills test behavior, and each exposes something a tabletop usually hides.
The dark channel
Tell responders that email and chat are unavailable and ask them to establish a working channel with every named participant. Record how long it takes and who could not join. The failure here is rarely technology. It is usually that nobody knew which channel was the fallback.
Isolate without asking
Give an on-call analyst a realistic scenario with a compromised server and watch. Do they know they may isolate it? Do they know how? Do they know who to inform afterward? Time the gap between recognizing the need and acting.
Who decides
Present a decision with a real cost: stopping a customer-facing system to prevent further spread. Record who is asked, who answers, and how long it takes to find the person with authority. If the answer changes depending on who is on shift, the authority model is not yet defined.
Do not chase an external benchmark for these times. Your own baseline, measured again after each fix, is more useful and more honest.
What to fix first
Fix declaration authority, out-of-band communication and privileged access first. Failures in those three block every other action, while failures further down the list slow actions that can still happen. This ordering is a practitioner judgment, not a standard, and an environment with a known backup weakness may reasonably reverse it.
Repeat the drills after each fix. A result that passed once, in a quiet week, with the right people in the room, shows that it can work. It does not show that it will.
Building exercises on existing material
NIST SP 800-84 covers how to design, develop, conduct and evaluate test, training and exercise events for IT plans and capabilities. CISA’s tabletop exercise packages provide customizable scenarios, facilitator and participant guidance, and an After Action Report template, and include a ransomware scenario. Both reduce the effort of building exercises from nothing.
Next step
**** Score your team on the nine checks using what you can demonstrate, and run the dark-channel drill this week. Cybrilliant’s incident response practitioners can facilitate readiness exercises and help turn the findings into a prioritized fix list.
Sources
-
NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management. https://csrc.nist.gov/pubs/sp/800/61/r3/final
-
CISA, #StopRansomware Guide. https://www.cisa.gov/stopransomware/ransomware-guide
-
U.S. Securities and Exchange Commission, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure: Fact Sheet. https://www.sec.gov/files/33-11216-fact-sheet.pdf
-
NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities. https://csrc.nist.gov/pubs/sp/800/84/final
-
CISA, Tabletop Exercise Packages. https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionDetect, Respond & RecoverSpot attacks early and get back to business fast.See how we work →Related service
Incident Response
Use this to improve incident readiness and response decisions.