Our Approach and Methodology
Could your organization benefit from guidelines on how to respond to
incidents effectively and efficiently? Would you feel more confident if you had
a roadmap for coordinating personnel, policies, and procedures to ensure
incidents are properly detected, analyzed, and handled?
Incident Response Plan Development will help to assist the organization in
mitigating the risks from computer security incidents by providing guidelines
with responding to incidents effectively and efficiently. The primary focus of
the IRP is to provide a roadmap for coordinating personnel, policies, and
procedures to ensure incidents are properly detected, analyzed, and handled.
This document is only a recommended guideline and solution to meet security and
mission requirements, and requires thorough testing and revisions.
The Incident Response Plan is designed to identify security incidents and to:
- Provide a central organization to handle incidents
- Provide appropriate and consistent responses to
such incidents
- Limit immediate incident impact to resources,
personnel, and data
- Reduce duplicated efforts on security incidents
- Reduce resolution time for security incidents
- Determine initial vector, or cause of such
incident
- Ensure proper and detailed reporting throughout
incident response
- Comply with government or other regulations
- Prevent the use of systems in attacks against
external resources
- Minimize the potential for negative exposure
- Ensure each incident is followed to a state of
resolution acceptable to the organization
The Incident Response Plan provides guidelines for implementing an incident
response program based on the organization’s policy. The plan will provide a
high-level approach for how the organization responds to incidents, and allow
for adjustments, testing, and revisions based upon unique requirements; such as
the mission, resources, size of organization, and functions. The Incident
Response Plan defines how often the personnel, groups, and handlers should be
tested and trained.
This document will include the following elements:
- Manager approval
- Strategies and goals
- Organizational approach to incident response
- The flow of communication between responders, outside resources, and the
organization as a whole Define testing and training requirements for maturing
the document