How to Create a Cybersecurity Incident Response Plan: Guide for 2024

Few organizations know how to handle a cybersecurity incident properly and minimize its impact on the business. Having a well-designed incident response plan (IRP) in place can save your organization time and resources spent on incident remediation.

We can help you build an efficient IRP. Read this post and create an IRP that fits your organization’s needs using the best practices from the NIST incident response planning framework.

Incident response plan: what is an IRP and why do you need one?

Many organizations are not prepared for incident response. According to S&P Global, only 42.7% of companies globally have a cybersecurity incident response plan and test it at least once a year. At the same time, one in five companies do not have an incident response plan at all.

What is an IRP?

IRP stands for an incident response plan (or program). It’s a set of written instructions enabling a timely response to data breaches, insider threats, and other cybersecurity incidents. An IRP elaborates measures to detect and identify an incident, respond to it, mitigate its consequences, and ensure it won’t reoccur.

[An] incident response plan is the documentation of a predetermined set of instructions or procedures to detect, respond to, and limit the consequences of malicious cyber attacks against an organization’s information system(s).

NIST Special Publication 800-34 Rev.1

Why is it important to have an incident response plan?

Any cybersecurity incident can take an unprepared organization by surprise, and recovering from such an incident can be a major drain on time and resources. Conversely, the presence of response plans indicates a developed cybersecurity culture in an organization. According to the 2023 Cost of a Data Breach Report by IBM, organizations with incident response plans and incident response teams manage to identify breaches 54 days faster and, accordingly, save more money on remediation.

Having an IRP is highly recommended for businesses of all sizes.

7 reasons to build an incident response plan

Here are seven reasons you should have an incident response plan:

1. Be prepared for emergencies — It’s vital to have a well-thought-out incident response process ahead of time, as security incidents occur without notice.

2. Coordinate cybersecurity efforts — An IRP makes it possible to immediately determine who should do what during an incident.

3. Resolve incidents promptly — Written procedures can reduce the time it takes to fully remediate an incident.

4. Reduce the damage — Shorter response times limit the perpetrator’s ability to cause critical damage to your sensitive assets.

5. Cover security gaps — The process of developing an incident response plan helps to reveal flaws in your organization’s security measures and address them in advance.

6. Gain critical knowledge — An IRP helps your organization acquire knowledge and experience in dealing with an incident, therefore preventing future occurrences.

7. Comply with cybersecurity requirements — Having procedures in place for incident response is a requirement of many cybersecurity standards, laws, and regulations.

Incident Response with Ekran System

Checklist for creating an incident response plan

When building or assessing your organization’s IRP, make sure you’ve covered the following ten recommendations:

Incident response plan template and examples

Some organizations use templates to make their own incident response plans. Below are a few ready-made incident response plan templates and examples of other organization’s IRPs for reference:

It may be tempting to copy-paste another organization’s cyber incident response scheme and just change names. However, an IRP must take into account each organization’s unique goals and problems in order to be effective. Please use these incident response plan examples and templates only as a point of reference.

Below, we review the NIST incident response guidelines that can help you create an incident response plan for your organization.

NIST guidelines for building an incident response program

The National Institute of Standards and Technology (NIST) provides a series of guides that your organization can use as a baseline for building your incident response program.

In particular, to effectively manage a potential cybersecurity incident, you can follow the Incident Response Recommendations and Considerations for Cybersecurity Risk Management [PDF], NIST SP 800-61 Revision 3.

According to NIST, an incident response process should include the following phases:

The six phases play an essential role in incident response and overall cybersecurity risk management. The Govern, Identify, and Protect phases represent preparation activities. They help prevent incidents and prepare you to handle them effectively, as well as reduce their impact and improve your organization’s defenses based on lessons learned.

Detect, Respond, and Recover phases represent the incident response life cycle. These phases allow you to discover vulnerabilities, manage and prioritize responses, contain and eradicate threats, and recover from damage.

Throughout each phase, there is a need for continuous improvements and amendments.

Now let’s take a close look at each of these phases separately.

Govern

Organizations should establish and communicate a comprehensive cybersecurity risk management strategy, which will guide all organizational cybersecurity risk management decisions. The strategy should define the context that governs all incident response processes in the organization, such as the organization’s goals, compliance requirements, and stakeholders’ expectations. The organization must ensure that cybersecurity policies and processes adhere to this context. Also, the policies need to be communicated clearly and monitored to ensure they remain relevant and effective.

Identify

Organizations must be aware of their current cybersecurity risks. This requires maintaining an inventory of all hardware, software, data, and personnel that are part of information systems.  Organizations need to assess how critical those assets are for their business operations. It’s also essential to evaluate potential cybersecurity risks regularly to identify and analyze vulnerabilities that could be exploited by threat actors.

NIST encourages organizations to enhance their ability to detect and respond to potential threats by gathering cyber threat intelligence (CTI) about threat actors’ tactics, techniques, and procedures (TTPs) from CTI feeds, information-sharing forums, and other sources. It’s also crucial to continuously improve cybersecurity risk management processes based on the outcomes of risk management and CTI gathering activities.

Protect

Organizations should implement appropriate security measures to manage cybersecurity risks. NIST emphasizes the necessity of securing information systems from unauthorized access and malicious activities through authentication and access control. Ensuring that employees are aware of cybersecurity risks is critical as well.

Organizations must also enforce robust security measures to protect the confidentiality and integrity of sensitive data, hardware, and software.

Detect

Organizations should be able to detect and analyze cybersecurity attacks and compromises efficiently. To support this phase of the incident response cycle and swiftly identify suspicious activity, organizations must continuously monitor all their assets. NIST also suggests deploying security information and event management (SIEM) or security orchestration, automation, and response (SOAR) tools for activity logging and analysis.

Respond

Organizations must take response actions once a cybersecurity incident is detected. Immediately upon detection, organizations need to implement their pre-planned incident response actions and coordinate efforts to reduce the negative impact and facilitate recovery. Every incident should be thoroughly documented for investigation along with a root cause analysis.

Organizations must also inform stakeholders and authorities about the incident and coordinate incident response efforts with them. Mitigation activities should continue until the incident is eradicated.

Recover

Organizations must restore assets and operations affected by a cybersecurity incident as soon as possible. At this phase, organizations need to restore normal operations and remediate vulnerabilities to prevent similar incidents. They also need to provide stakeholders and the public with updates on the recovery process.

We’ve covered the basics of the incident response process, so let’s now discover how to implement your own NIST-compliant IRP.

Meeting NIST Compliance Requirements with Ekran System

Tips for implementing a NIST-compliant incident response plan

Earlier this year NIST published a lengthy and detailed update to its recommended incident response steps. For your convenience, we’ve condensed this guide into a compact checklist of the following five best practices:

1. Set responsibilities

Everyone should know their role.

In the past, incident response activities were primarily managed by internal cybersecurity incident response teams (CIRTs). While having your own team of incident handlers is still a good practice, it’s no longer enough for effective incident response. The success of incident response now depends on coordinated efforts from a range of internal and external stakeholders.

Thus, you need to distribute incident response responsibilities across your organization and make sure that everyone understands their roles in the incident response process. NIST provides the following list of concerned personnel:

Incident handlers verify incidents, collect and analyze data and evidence, prioritize response activities, and take appropriate actions to limit damage, identify root causes, and restore operations. Additionally, they advise on mitigating cybersecurity issues and enhancing resiliency. Incident handlers may include the internal incident response team, contractors, or on-call service providers.

Leadership needs to oversee incident response processes, allocate funding, and hold decision-making authority for high-impact actions like shutting down critical services or rebuilding authentication systems.

Technology professionals, such as technology architects, engineers, and administrators need to support response and recovery efforts with technological expertise.

Legal experts ensure compliance with applicable laws and regulations by reviewing incident response plans, policies, and procedures. They also evaluate contracts with technology suppliers and third parties as well as provide consultations in case of legal ramifications, such as prosecutions, lawsuits, or the need for binding agreements.

Public affairs and media relations managers should develop a media engagement strategy to prevent misinformation. They inform the media and public about the incident when applicable.

Human resources must perform pre-employment screening, employee onboarding and offboarding, and position changes in accordance with your organization’s cybersecurity policies.

Physical security and facility personnel need to provide access to compromised workstations if needed.

Asset owners, such as system, data, and business process owners, must provide prioritization information for the response and recovery of each affected asset to incident handlers.

Your organization can engage third parties to support any of these roles and responsibilities. However, you need to make sure that the responsibilities of both your organization and a third party are clearly defined in a contract.

2. Plan all procedures in advance

Planning is vital.

Should a cybersecurity incident take place, your incident handlers need to know exactly how to manage it with minimal losses. You need to establish and battle-test your information security response plan before any real-life incident occurs.

Your incident handlers need to accomplish four main tasks at the planning stage:

First, determine what events are considered cybersecurity incidents. Then, write an incident response plan for each type of incident.

The Computer Security Incident Handling Guide by NIST [PDF] specifies a list of attack vectors and suggests developing a common incident response scenario for incidents that use the same attack vector.

Next, prioritize possible threats and attacks based on their impact on your business. After all, there’s no sense in wasting time on managing minor attacks when a critical breach remains unaddressed.

The NIST incident response framework offers three impact-based criteria for determining an incident’s priority:

Once you prioritize possible incidents, start planning standard procedures for responding to them. Develop containment strategies and standard operating procedures (SOPs) for the most common events, such as system failures, denial of service, intrusion, and spyware infection.

In your SOPs, specify the technical processes, techniques, checklists, and forms for the incident handlers to use in the event of a particular incident.

You can refer to NIST Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response, for further guidance on establishing proper response procedures.

3. Monitor user and network activity

If you can see it, you can manage it.

Monitor everything that happens in your network to prevent potential attacks, detect suspicious events, and identify shadow IT cases. Consider deploying a user activity monitoring solution to address insider threats and third-party-related security risks.

By keeping an eye on the activity of individual users and entities in your network, you can:

• Detect and terminate an attack at an early stage.
• Collect evidence and valuable data for further analysis.

When choosing a user activity monitoring solution, look for one with a flexible incident response system. Being able to set custom alerts and automate at least some SOPs will help you ensure a timely response to cybersecurity incidents.

Consider implementing a solution with user and entity behavior analytics (UEBA) functionality. AI-powered technology can automatically detect deviations from baseline user behavior, indicating early signs of account compromise or insider activity.

Also, consider limiting access to sensitive data by deploying identity and access management solutions.

4. Take care of backups and recovery strategies

No one wants to lose valuable data.

A recovery strategy is a key part of any IT incident response plan.

Start by determining what data is most valuable to your business and take extra care protecting it. This will let you know what to focus on during a real-life cybersecurity incident: what data you’ll need immediately and what assets can be restored later without damaging the business.

There are two major tasks for your incident handlers to keep in mind regarding the organization’s recovery from a cybersecurity attack or data breach:

Data recovery. It will be difficult to quickly counter a cybersecurity incident without a backup system. Deploying a data loss prevention tool and creating, maintaining, and testing backups will help you safely restore all business-critical information.

For better protection of critical data, choose a hybrid backup solution combining on-premises and cloud-based services.

Before using a backup for recovery and restoration operations, verify the integrity of the backup.

Service restoration. The following two steps are critical for restoring your organization’s systems to a normal state after an incident:

• Check your network together with asset owners to confirm that all systems are operational.
• Monitor the performance of the restored systems to confirm that the restoration is successful.

Reset passwords for users of breached accounts and block accounts and backdoors that could have enabled the intrusion. For maximum protection, follow NIST password guidelines.

5. Update your incident response plan regularly

There’s always room for improvement.

NIST suggests reviewing an IRP periodically or when a significant improvement is needed. However, new cybersecurity threats require organizations (especially large companies) to check and update their IRPs more frequently.

Mirror any significant business changes in your IRP, be it entering a new sphere or changing your internal infrastructure.

If your organization is a potential target for a new cybersecurity threat, it’s important to prepare an adequate incident response scenario for this type of attack. Plan, test, and document all procedures and recovery tools related to the new threat.

Examining how your organization and other companies handle real-life incidents is also essential. Such analysis can show you if your current strategy works well and what you can do to prevent such future incidents.

Handling incidents with Ekran System

We recommend enhancing your IRP measures with dedicated incident response solutions.

Ekran System is a universal insider risk management platform that combines reactive and proactive approaches to handling user-related incidents.

This is just a small selection of the features Ekran System has to offer. Among other things, you can use Ekran System for the purposes of USB device management, security incident investigation, and remote session recording.

Ekran System helps you meet the most important IT compliance requirements, including those imposed by NIST, HIPAA, and PCI DSS.

Meeting IT Compliance Requirements with Ekran System

Conclusion

Incident response planning is an integral part of a successful cybersecurity strategy. Instead of using IRP templates, we recommend building a customized incident response plan that reflects your organization’s specific requirements. This way, you’ll be able to respond to incidents quickly and minimize any possible damage.

Use this selection of tips and best practices inspired by NIST for your organization’s incident response. Build a cybersecurity incident response team, plan their actions in advance, monitor user activity, establish backup and recovery procedures, and don’t forget to update your IRP regularly.

Robust cybersecurity solutions like Ekran System help you boost and automate your incident response capabilities.