# Incident Response Plan

> ISO/IEC 27001:2022 A.5.26 (response planning) + A.5.27 (learning
> from incidents) + 27035 guidance. Pre-write the plan; execute during
> incident without improvisation.

| Field | Value |
|-------|-------|
| Document ID | DOC-ISMS-020 |
| Owner | Security lead / CISO |
| Tested | Tabletop YYYY-MM-DD |
| Next review | YYYY-MM-DD |

## 1. Incident classification

| Severity | Definition | Examples | Response time | Escalation |
|----------|------------|----------|---------------|------------|
| S1 Critical | Major CIA loss, active breach | ransomware, data exfiltration | immediate | exec + legal |
| S2 High | Significant impact, contained | malware detected, partial outage | 1 hour | security lead |
| S3 Medium | Limited impact | failed attack attempt | 4 hours | on-call |
| S4 Low | Minimal impact | policy violation | 1 business day | ticket queue |

## 2. Response phases

```mermaid
flowchart LR
    D[Detect] --> T[Triage] --> C[Contain] --> E[Eradicate] --> R[Recover] --> L[Lessons learned]
```

| Phase | Actions | Owner | Timeframe |
|-------|---------|-------|-----------|
| Detect | alert, report channel | monitoring/anyone | – |
| Triage | classify severity, assemble team | on-call | < 1h |
| Contain | isolate, preserve evidence | IR team | hours |
| Eradicate | remove cause, patch | IR + eng | days |
| Recover | restore, verify integrity | ops | per RTO |
| Learn | post-incident review | all | ≤ 1 week |

## 3. Roles & contacts

| Role | Primary | Backup | Contact |
|------|---------|--------|---------|
| Incident commander | @name | @name | phone |
| Technical lead | @name | | |
| Comms lead | @name | | |
| Legal counsel | @firm | | |

## 4. Communication

- Internal: escalation matrix by severity
- External: regulator notification (GDPR 72h), customer notice per contract
- Template statements pre-drafted per severity

## 5. Evidence & forensics

- Preserve: logs, images, timeline – chain of custody
- Do NOT: wipe evidence, turn off before imaging

## 6. Exercises

- Tabletop: every 6 months
- Full simulation: annually
- Record: exercise report feeding improvement

## 7. Learning loop (A.5.27)

Every incident → root cause → corrective action in CAPA register →
update this plan and controls.