The unwritten incident response plan
If my last week of incident work is predictive of everybody's next month, you're going to be doing more incident response too.
Here's what the first few hours of an incident look like. Let's be real, you probably don't have an IR plan. I've been advising incident response efforts for almost 20 years and these are my thoughts.
0. Get the lawyer's advice on privilege and disclosure.
You can find a lawyer through your existing lawyers 99% of the time. Ask them how to investigate under attorney client privilege and start working through your disclosure obligations. Lawyers do not handle privilege consistently. They'll say whatever practice they recommend is standardized and well explored. It's not. Find counsel you trust and work with them anyways.
Now that it's 2026, ask them how you're able to protect your investigative interactions with AI under privilege. Apologies in advance for the answer you'll probably get.
1. Make it easy to onboard new responders.
You'll be onboarding new helpers over and over again. Executives, co-workers, consultants, vendors, etc, will all need a brief. Start a single shared folder and create an incident channel. Less fragmented information will make it easier to bring new parties into the loop and reduce access requests. Access requests are, maybe, 80% of early IR coordination. That's my guess.
2. Start the incident tracking document.
It should start with four sections. Don't clutter it up with big compliance preambles, huge tables of contents, or lists of stakeholders if you expect others to actually use this document. If you must, put that stuff at the bottom or tucked away in a tab. This document is for an actual investigation. Keep it simple.
- 🗓 Summary and Timeline:
- The summary needs to be actually readable. The document is how people onboard without asking for a meeting.
- The timeline should be supported by evidence, and link to where that evidence lives.
- 🐛 Evidence and IOCs: These are the strings of data that responders will turn around, pivot off of, and query around for on different systems.
- 🧐 Investigative Q&A: Make a wishlist of the questions you need to have answered. Assign owners.
- Where did that secret exist in plaintext? (Bob)
- Who has access to the compromised host? (Alice)
- How do we get in touch with
$vendor? (Mallory)
- 🤚 Everything Else: All of the remediation items, the meeting locations, information on the next sync up, the dial-ins, etc.
3. Create a meeting cadence for syncs.
Set expectations among responders for frequent check-ins and live syncs. The first day can be as frequent as hourly. Of course, make a point to reduce this at the end of every sync. Know where everyone will be, and when they'll be offline for a while.
That's all. The rest is forensics, deduction, intel sharing, etc.
I have more writing on incident response at scrty.io, particularly An Incident Response Plan for Startups and Running an investigation.
Also, don't forget about Bad Things Daily. I'll put up some AI related tabletops.