Incident response

Make authority and access available before they are needed

Identify the incident lead, technical responders, service owner, communications contact and people responsible for legal or contractual questions. Define escalation conditions and alternate contacts. Confirm that responders can reach the relevant systems and records even if the normal identity platform is unavailable.

NIST SP 800-61 Revision 3 places incident response within CSF 2.0 risk management. Use that connection to organize readiness, detection, response and recovery. The runbook still needs decisions that apply to the organization’s own services and dependencies.

An unfamiliar session does not explain itself

In a fictional tabletop, a software company receives an alert about an unfamiliar administrative session and a large export. Start with those observations rather than deciding in advance that a breach occurred. Identify what would confirm authorized activity, which evidence needs preservation and which actions could interrupt service.

The team considers revoking the session, temporarily restricting exports and preserving relevant logs. Each action has an owner and an expected effect. The facilitator then adds that the account also supports an operational integration. The team must account for that dependency before treating containment as a change with no business consequence.

Record what was known when the decision was made

Keep the observation and the reason for acting together. Later evidence may change the explanation, but the record should still make it possible to assess the decision using the information available at the time.

Verify that containment worked

Check that the intended session or credential no longer works and that required service paths behave as expected. Preserve timestamps and relevant state before changing them where feasible. Do not postpone necessary containment solely to produce a perfect record. Explain the tradeoff and any evidence that was lost.

Restrict access to incident evidence and distribute it only where needed. Notification requirements depend on the facts, contracts and applicable law. Involve the responsible specialists rather than assuming one generic deadline applies to every incident.

Check the service before calling it recovered

Recovery includes restored service, validated access, monitoring and confirmation that the initiating condition has been addressed. After the exercise or incident, assign a small set of concrete improvements with owners and retests. The follow-up matters when it changes how the next response works.