EDUCATION, INCIDENT, RESPONSE

🚨 Incident response - cyber incident management (IR)

Seven topics on cyber incident response - from event to training - by international practice (NIST SP 800-61, SANS PICERL, ISO/IEC 27035, ENISA). Time limits and examples are illustrative, intended for training.

Basic concept and roles

Event → warning → incident → violation

Incident escalation and response team Escalation from the event to the alert, incident and infringement; triage screening the non-important; under it incident response team role. Incident escalation Not every event is an incident - the triage decides what requires response Event any observation log entry, login Warning automatic trigger SIEM, EDR, IDS Incident confirmed damage or real threat CIA Infringement data/systems compromise Triage: is it an incident? classified and prioritised Incident response team (CSIRT / CERT / SOC) Manager coordinate response decisions, escalation Analyst (SOC) detect, investigate SIEM, EDR Triage Forensics (DFIR) evidence cause analysis Communication internal regulators, customers Legal management, lawyers compliance, HR NIST SP 800-61r3 (concepts), ISO/IEC 27035-1:2023, ENISA CSIRT Guidelines

In practice

Common language: when an event becomes an incident and who does what. Clear roles and escalation reduce chaos response in the first minutes.

Reference

NIST SP 800-61 Rev. 3, ISO/IEC 27035-1:2023, ENISA "Good Practice Guide for Incident Management'.

Safety Note

Command and contacts shall be coordinated BEFORE incident. The plan, which is first read during an incident, is too late - preparedness is the first step of the cycle.

Response Life Cycle

NIST SP 800-61, SANS PICERL and ISO/IEC 27035

Lifecycle Response for Incidents NIST four phases with feedback loop and linking it to the six steps of the SANS PICERL and the five phases of ISO/IEC 27035. Response Life Cycle - Four Phases Classical model (NIST SP 800-61 Rev. 2, SANS) - training improves preparedness 1 plan, command tools, training playbooks, logging 2. Disclosure and analysis triage, volume classification, priority 3. Restrictions eradication renewal insulating, clean, renewed 4. Following an incident training report, improvements rCA better preparedness → Four frames, one idea - different steps detail NIST r3 (2025) Government + Identity + Protect (preparedness) → Detect → Reply → Recover, improvements throughout the cycle NIST r2 (2012) Preparation → Detection/analysis → Restriction/Eradication/Renewal. → After incident SANS PICERL Preparations → Identification → Contain → Eradication → Recover → Lessons learned ISO 27035 Planned/prepared → Discover/report → Evaluated/decision → Respond → Learn NIST SP 800-61 Rev. 3 (2025, replace Rev. 2), SAN PICERL, ISO/IEC 27035-1:2023

NIST Rev. 3 is no longer meant to be a separate phase - it takes place continuously (Govern, Identity, Protect and Improvements). Four phases still fit well for team work during the incident itself. Choose one set of terms and stick to it.

In practice

Split the response stages to keep the steps on the stream. One cycle fits both a technical team and management reports.

Reference

NIST SP 800-61 Rev. 3 (2025, by CSF 2.0 functions), SANS Incident Handler's Handbook (PICERL), ISO/IEC 27035-1:2023.

Safety Note

The most common error - skip the post incident phase. Without training and prevention of the cause, the same incident recurs; the cycle remains unfinished.

NIST SP 800-61 Rev. 3 - Government, Identity, Protect

Plan, manuals and exercises - before incident

Preparation cycle Plan, manuals for each type of incident, training and improvements that return to the plan. 1 roles and alternates contacts, escalation who decides on reporting Manuals extortion virus account take-over data leak, DoS 3. Training quarterly table training technically annual with management 4. Improvements findings with responsible and maturity plan is renewed every training and every real incident

Manual design

PartWhat it determinesExample: Eraser virus
TriggerWhen the Manual opensEDR alert for mass file encryption
First 60 minsConcrete steps and who does itInsulate affected hosts, stop backup deletion, convene command
DecisionsDeciding and CriteriaInsulate or observe, disable service, involve police
CommunicationTo, when and through some channelManagement within 30 minutes, employees, customers - via reserve channel
ReportingExternal obligationsNIS2 - 24 h, GDPR - 72 h when personal data are affected
EndWhen the incident is closedUpdated from verified copies, cause eliminated, training recorded

In practice

The plan shall demonstrate that the organisation can react. The training shows that it does - and reveals where the plan does not work before the attacker discovers it.

Reference

NIST SP 800-61 Rev. 3 (2025), NIST SP 800-84 (training and testing), ISO/IEC 27035-2:2023, CISA Tabletop Exercise Packages.

Safety Note

Plan and contacts should also be available if the email and internal wiki are compromised - keep the printout and backup communication channel. Business continuity.

Discovery, triage and classification

Signal to Priority - Levels of gravity

Sources of detection and severity classification of incidents The sources of detection on the left side flow to the triangle; on the right side the table of severity levels from SEV-1 to SEV-4 with response time. Discovery, triage and classification The severity level determines response rate and escalation Discovery sources SIEM, correlated magazines EDR / XDR, terminal equipment IDS/IPS, Network Flow User reports Crying intelligence, IOC Triage volume, class Height levels (example) SEV-1 Critical continuous, basic service standing SEV-2 High hours, partial effects SEV-3 Medium working day, limited impact SEV-4 Low planned, minimal impact Triage Issues - What's affected? (CIA, service, data) - How extensive? or continuing? - Should the regulator be reported? (see Message tab) ENISA taxonomy common classification for reporting (evil, intrusion, DoS, fraud, data quality...) NIST SP 800-61r3 (Detect), ENISA Reference Incident Classification Taxonomy, MITRE ATT&CK

Number of levels (SEV-1...4 or P1...P4) and thresholds must be aligned with the organisation. The main thing is a single, predefined scale, which everyone understands in the same way.

In practice

Triage screening noise and giving priority. The severity level determines how quickly to react, what to escalate and whether to start a reporting watch.

Reference

NIST SP 800-61 Rev. 3, ENISA Reference Incident Classification Toxonomy, MITRE ATT&CK (technical mapping).

Safety Note

Do not underestimate the severity to avoid reporting - some deadlines start from the moment the incident is detected. Reclassification if volume increases.

Active response

Restriction → Eliminating → Restoring

Restrictions, eradication and restoration Three consecutive stages with actions, while preserving evidence throughout the course. Restrictions, eradication, restoration First stop the spread, then eliminate the cause, then reliably restores 1. Restrictions - Short term: isolate affected (disconnect network, segment) - Long-term: temporary correction - Block C2, cancels access Target: Stop spread without damaging evidence 2. Eradication - Eliminates the original cause - Deleting malware, closing accounts - Patch vulnerability - Change the compromised to hide. Objective: remove the attacker from all environments, not just one 3. Renewal - Restore from clean backups - Checks integrity - Enhanced monitoring - Gradual return to work Objective: Safe normal operation Within the objectives of RTO / RFMO √ Preservation of evidence and chain of records - throughout the response in parallel Insulate or observe: rapid isolation stops damage, but can warn the attacker and destroy the foot. Restores only after prevention of the cause - otherwise the attacker returns along the same path (repeated incident). Duplicates shall be tested before renewal and may contain the same malware or rear door. NIST SP 800-613 (Respond, Recover), RFC 3227 (evidence), ISO/IEC 27035-3

In practice

A clear sequence of actions in crisis: first stop, then clear, then restore. For each step - pre-prepared playbook for a particular incident type.

Reference

NIST SP 800-61 Rev. 3, ISO/IEC 27035-3:2020 (operations), RFC 3227 (evidence collection), SANS PICERL (Contain/Eradicate/Recover).

Safety Note

The quick "cleaning" leaves the attacker elsewhere in the system before the volume is cleared. First, find out where the attacker was, then clean it all at once.

Legal reporting

Reporting deadlines - NIS2, GDPR and CERT.LV

Time limits for reporting incidents Time axis from incident detection: NIS2 early warning within 24 hours, notification and GDPR data breach message within 72 hours, NIS2 final message within one month. Reporting deadlines (NIS2 / GDPR) Clock starts from incident awareness - document this moment 0 h Opening incident identified start recording time 24 h Early warning NIS2 → CSIRT/CERT.LV initial information 72 hours Notification NIS2 incident notification + GDPR 33 (if affected by PII) 1 month Final report NIS2 → cause impact, measures Article 33 of CRR (personal data) - 72 h for the supervisory authority (LV: DVI) - In case of high risk, also for data subjects - Separate from NIS2 (may coincide in time) NIS2 Article 23 (LV: National Cybersecurity Act) - 24 h warning → 72 h notification → 1 month. - Addressee: CSIRT / CERT.LV - Major/important entities, interim reports on request NIS2 (Dir. 2022/2555) 23, GDPR (Reg. 2016/679) 33/34, National Cybersecurity Law, CERT.LV

The specific time limits and addressees depend on the type of entity and jurisdiction - this is a general scheme. Verification of the exact requirements in regulatory enactments and by CERT.LV.

Step by step reporting

General framework for a significant incident that also affects personal data. The organisation is in the middle - it reports to two institutions separately.

Significant incident with personal data

  1. 1
    OrganisationAware of a major incident - this is the moment from which time starts to run

    The time limit shall begin to run from awareness or from the end of the investigation. Don't wait until everything is known.

  2. 2
    Organisation → CSIRTEarly warning - 24 h

    Report: whether it could be abusive and whether it affects other countries

    Short message: what happened and whether there is suspicion of an attack. Details are not required yet.

  3. 3
    CSIRT → OrganisationFirst response and assistance on request

    CSIRTs respond within 24 hours and can help with containment.

  4. 4
    Organisation → CSIRTIncident message - within 72 hours

    Report: initial assessment, severity, impact, signs of compromise

    Specify the early warning with what was learned in the first three days.

  5. 5
    OrganisationPersonal data affected? If yes, this is a separate obligation for GDPR

    One incident may require two reports to two institutions.

  6. 6
    Organisation → DVIData breach notification - within 72 hours

    Report: what data, how many persons, consequences and measures taken

    Article 33 of CRR. If everything is not yet known, the information may be provided in instalments.

  7. 7
    OrganisationHigh risk to persons → informs persons themselves without undue delay

    Article 34 of the GDPR: People need to know that they can act for themselves, for example to change their password.

  8. 8
    Organisation → CSIRTFinal report - within one month of notification

    Report: cause, action taken, transboundary impact

    If the incident is still ongoing, a progress report and a final report shall be submitted within one month of its end.

In practice

A clear maturity scheme helps not to miss legal windows. Reporting decisions and contacts include playbook - during the crisis there is no time to search.

Reference

NIS2 Directive (EU) 2022/2555 Article 23, Article 33/34 of the GDPR, National Cybersecurity Law and its downstream legislation, CERT.LV reporting procedures.

Safety Note

NIS2 and GDPR have separate responsibilities - one incident may require both reports to different authorities. The time limit shall begin to run from awareness, or from the end of the full investigation.

Standard map and metrics

Frames, taxonomies and response metrics

Landscape and metrics of incident response standards Eight standard and framework groups in two rows, below which four main response metrics. Standard landscape and metrics Process frame + taxonomy + compliance - total full IR program NIST SP 800-61 Rev. 3 handling incidents SP 800-86 forensics in response CSF 2.0 Respond, Recover SANS PICERL 6 step model Handler's Handbook practical manual playbooks scenario steps ISO/IEC 27035-1/2/3 incident management 27001 A.5.24-A.5.28 control ISMS 27037 digital evidence Axolotls ENISA RICT incident classes MITRE ATT&CK attack techniques VERIS description of infringements Coordination (EN) CERT.LV national CSIRTs sectoral CSIRTs sector teams FIRST global CSIRTs Network EU / LV eligibility NIS2. reporting obligation National Cybersecurity Law EN implementation GDPR 33/34. data breach Sector DORA financial ICT incidents PCI DSS 12.10 payment cards HIPAA health data (USA) Exchange TLP 2.0 partition marking STAX / TAXII IOC exchange MISP threat platform Main response metrics MTTD mean time of discovery MTTA mean response time MTTR middle resolution time Dwell time presence of an attacker

In practice

Helps to assemble a full IR programme: process (NIST/SANS/ISO), taxonomy (ENISA/ATT&CK), compliance (NIS2/GDPR) and measurement (MTTD/MTTR).

Reference

NIST SP 800-61/86, ISO/IEC 27035, ENISARICT, MITRE ATT&CK, VERIS, FIRST, NIS2, National Cybersecurity Act, GDPR, TLP 2.0.

Safety Note

Indicators help improve work, but may mislead: a "fast-closed" incident with incomplete cleaning is a bad sign. Watch the indicators along with what the team learned from the incident.

Abbreviations

All abbreviations used in the guide (original and meaning).

IR
Incident Response - incident response.
CSIRT
Computer Security Incident Response Team.
CERT
Computer Emergency Response Team.
CERT.LV
Latvian national cyber security incident prevention team.
SOC
Security Operations Center - Security Operations Centre.
SIEM
Security Information and Event Management - Security Events Management.
EDR / XDR
Endpoint / Extended Detection and Response - terminal equipment and extended detection.
IDS / IPS
Intrusion Detection / Prevention System - intrusion detection/prevention.
IOC
Indicator of Compromise - a compromise indicator.
DFIR
Digital Forensics and Incident Response - digital forensics and response.
RCA
Root Cause Analysis - a root cause analysis.
CIA
Confidentiality, Integrity, Availability - confidentiality, integrity, accessibility.
C2
Command and Control - An attacker's control channel.
SEV / P
Severity / Priority - severity/priority level (SEV-1...4).
NIST SP
NIST Special Publication.
PICERL
Prepare, Identify, Container, Eradicate, Recover, Lessons Leaded (SANS).
CSF
Cybersecurity Framework - NIST cybersecurity framework (2.0).
MTTD
Mean Time To Detection - average opening time.
MTTA
Mean Time To Acknowedge - mean time for response (confirmation).
MTTR
Mean Time To Reply/Recover - mean resolution/renewal time.
RTO
Recovery Time Objective - permissible renewal time.
RPO
Recovery Point Objective - allowable amount of data loss.
NIS2
Network and Information Security Directive 2.
GDPR
General Data Protection Regulation - General Data Protection Regulation.
DVI
Data State Inspectorate (LV Data Protection Supervisor).
ENISA
European Union Agency for Cyber Security.
RICT
ENISA Reference Incident Classification Toxonomy.
VERIS
Vocabulary for Event Recording and Incident Sharing (Verizon).
ATT&CK
MITRE opponent tactics and technical knowledge base.
FIRST
Forum of Incident Response and Security Teams.
DORA
Digital Operational Resilience Act - EU financial sector resilience regulation.
PCI DSS
Payment Card Industry Data Security Standard.
TLP
Traffic Light Protocol - Information sharing label (2.0).
STIX / TAXII
Standards for describing and exchanging crypto intelligence.
MISP
Malware Information Sharing Platform - threat exchange platform.