A major breach changes the rules of incident response. The email system may be part of the incident. The directory that grants everyone’s access may be too. Scope stays uncertain for days, and outside notification clocks keep running while you work it out.
This playbook covers what to build and test beforehand. It assumes a response team already exists. For how that team performs under pressure, see the incident response readiness note listed below. For the executive side, see the crisis management briefing.
The starting position the threat data suggests
Mandiant’s latest M-Trends report draws on its own incident investigations. Exploited vulnerabilities were the most common initial infection vector at 32% of intrusions. Voice phishing was second at 11%, and email phishing fell to 6%. Median dwell time rose to 14 days from 11. Organizations spotted the intrusion themselves in 52% of investigations. For ransomware, the report describes operators going after backup infrastructure, identity services and virtualization management planes.
Two cautions. Mandiant sees organizations that called for help, so the sample leans toward serious cases. And a median hides the long tail: the same report puts cyber espionage dwell time at a median of 122 days.
Read together, the data points to a planning assumption. By the time you declare a major breach, the attacker has probably been inside for days, and may already have touched the systems you would use to respond. That is an interpretation, not a measured result, but every item below follows from it.
Nine things to have in place
For each one, the right-hand column is a test you can run without waiting for an incident. If you cannot pass the test, the item does not exist yet.
| Workstream | What has to exist | Test it by |
|---|---|---|
| Declaration and decision rights | Written criteria for calling an incident major. A named incident lead with authority to act, and a deputy for every role. | Ask three people separately who can approve taking a business-critical system offline. The answers should match. |
| Out-of-band command channel | A way to talk and keep records that does not depend on corporate email, chat or single sign-on. Contact lists held offline. | Run the first 30 minutes of a drill with corporate email and chat declared unavailable. |
| Scope data | A map of where regulated and sensitive data lives, who owns each system, and which log sources cover it. Log retention that outlasts a realistic dwell time. | Pick one regulated dataset. Time how long it takes to list every system that stores or processes it. |
| Access that survives a directory compromise | Break-glass accounts and admin workstations that do not rely on the directory that may be compromised. Credentials stored offline. | In a test environment, reach a core system with the primary directory disconnected. |
| External parties | A signed forensic and incident response retainer, outside counsel, insurer notice terms, regulator and law-enforcement contacts, emergency numbers for critical vendors. | Read the retainer. Does it state response times and cover your cloud and SaaS estate? Check the insurer’s panel rules before engaging anyone. |
| Notification clock | A tracker recording when awareness or materiality was reached, who decided, and which regimes apply. | Walk a dummy incident through it. Every clock should have a named owner. |
| Pre-approved containment options | A menu of actions with the business impact stated and the approver agreed in advance: isolate a segment, disable federation, block egress, suspend vendor access. | For each action, record who approves it, how long it takes and what stops working. |
| Evidence handling | A tested procedure that stops containment from destroying evidence. | See Playbook: Preserving Evidence During Incident Response. |
| Recovery path | A restore route that does not trust the compromised environment. | See Playbook: Testing Ransomware Recovery. |
Notification clocks to map before you need them
The clock usually starts at a judgment call: when you became aware, or when you decided the incident was material. That makes the decision log part of your compliance evidence. Record what was known, when, and who decided.
| Regime | Clock | Starts when | Worth knowing |
|---|---|---|---|
| GDPR, Article 33 | Without undue delay and, where feasible, within 72 hours | The controller becomes aware of a personal data breach | Not required if the breach is unlikely to result in a risk to individuals. Information can be provided in phases. Processors must tell the controller without undue delay. |
| U.S. SEC Form 8-K, Item 1.05 | Four business days | The registrant determines the incident is material | Applies to U.S. registrants. Delay is possible only if the U.S. Attorney General finds a substantial risk to national security or public safety. |
| Sector and national regulators | Varies | Set by each regulator | Central banks, aviation, telecom and critical infrastructure authorities often set their own timelines. Counsel should confirm which apply. |
| Contracts and cyber insurance | Varies | Set by each agreement | Customer contracts and policies frequently carry their own notice terms. Collect them in one register. |
Counsel decides which regimes apply. The playbook’s job is to make sure the facts counsel needs are available in time.
The first hour
1. Declare the incident and name the incident lead.
2. Move to the out-of-band channel. Tell participants to keep discussion off corporate email.
3. Open the decision log: time in UTC, decision, who made it, what was known.
4. Start preserving evidence before containment changes it. Volatile data and logs come first.
5. Pick containment from the pre-approved menu. Accept that some options will interrupt the business.
6. Bring in counsel and the forensic retainer. Start the notification tracker.
7. Brief the executive sponsor on what is known, what is not, and which decisions are needed. Leave attribution out until the evidence supports it.
Where preparation usually fails
-
The plan lives inside the environment under attack. A runbook on a shared drive or wiki is unreachable when you need it. Keep an offline copy and check it is current.
-
Log retention is shorter than the intrusion. If logs go back 30 days and the attacker arrived earlier, you cannot establish scope. Retention should be set against dwell time, not storage cost alone.
-
Containment needs a change board. A decision that takes a day to approve is not a containment option. Pre-approve the actions and the people who can trigger them.
-
Counsel and forensics arrive late. If they are called on day three, conclusions may already sit in email threads. Whether privilege holds depends on the jurisdiction and on how the work is structured, so settle that with counsel beforehand.
-
Drills only cover phishing. A scenario where an internet-facing system was exploited and the first sign is quiet credential theft calls for a different first hour. Rehearse both.
Three checks to run next
1. Out-of-band drill. Thirty minutes, no corporate email or chat. Note what breaks.
2. Data-scope timing. Name one regulated dataset and time the list of every system touching it. If it takes days, that gap will cost you on day one.
3. Authority test. Ask who can take a critical system offline. Compare the answers.
Record the results, fix the gaps, and repeat the failed checks. A check that passes once because the right person was available proves little. Run it again with a different deputy.
Next step
Start with the out-of-band drill, since it exposes the most gaps for the least effort.
Sources
-
Google Cloud / Mandiant. M-Trends, latest annual report — initial infection vectors, dwell time, detection source, ransomware targeting of backup, identity and virtualization infrastructure. cloud.google.com/blog/topics/threat-intelligence
-
NIST. SP 800-61 Revision 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile. csrc.nist.gov/pubs/sp/800/61/r3/final
-
European Union. General Data Protection Regulation, Article 33 — notification of a personal data breach to the supervisory authority. gdpr-info.eu/art-33-gdpr
-
U.S. Securities and Exchange Commission. Cybersecurity risk management, strategy, governance and incident disclosure rule, Form 8-K Item 1.05. sec.gov
-
CISA and partner agencies. #StopRansomware Guide. cisa.gov/stopransomware/ransomware-guide
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionDetect, Respond & RecoverSpot attacks early and get back to business fast.See how we work →Related service
Breach Response
Use this to improve breach response coordination.