Incident response check list

1. Preparedness and roles

Incident response plan is written and achievable - Even when network and internal documents are not available. A valid copy is printed or stored separately.
There is a designated person who directs the response - Its mandate, responsibility and substitute shall be laid down in writing.
Team roles are divided according to specific responsibilities, not by departments - Who investigates technically, who communicates, who gives legal aid and who makes a decision.
Anyone may disconnect the system from the network without further coordination - If every isolation step requires a management approval, the attacker works faster than the process.
The contact list is current and available outside target systems - Internal, suppliers, supervisory authorities and law enforcement.
Access to external aid is arranged in advance - Investigation service, legal aid and communications. Contracting during an incident is slow and expensive.
It is known whether cyber risk insurance exists and what it requires - Part of the policies require notification within a specified time limit and not change the systems before the survey.
Possible scenarios are sorted by impact - Data leaks, data encryption with compression, service interruption and supplier's incident require different steps.

2. Disclosure and application

System and network events are monitored continuously - And we know who reacts to the alert outside working hours.
An incident is reported by one known channel - Two channels mean that some applications do not reach the responsible.
Employees know how and how quickly to report a suspicious event - Checked with the question to the employee, not with the assumption that the instruction has been read.
External rapporteur can reach the organisation - Published address for vulnerability and incident reporting, with a deadline for response.
Logs cover systems where the incident is likely to start - Access, authentication, network border and administrator activities.
The time of all systems is synchronized to one source - Without this, the sequence of events between the two servers cannot be demonstrated.
False alarms are reduced, not ignored - A warning that no one opens is the same as a warning.

3. Evaluation and classification

Incidents have a scale of gravity with clear thresholds - The scale determines the rate of reaction, so it is necessary before, not during, an incident.
It is known when an incident becomes significant - Public health or safety at risk, loss of at least EUR 500 000 or 5% of turnover, damage to life or health, impact on information on restricted access, significant disruption of service or cross-border impact.
The incident is recorded in the log within 24 hours of detection - The time limits shall be calculated from the moment the incident is established.
The record shall contain the time of detection, type, description, causes, effects and status - It also notes here whether the incident is significant.
Escalation path to control is defined by time limit - Management learns from the process, not from news portal.
Assessment of whether personal data are affected - The assessment begins immediately because it has a separate addressee and a separate deadline.
The decision on classification is recorded with time and the acquirer - It shall subsequently be verified whether the decision was based on the information available at that time.

4. Restrictions

Affected system is disconnected from network instead of off - Exclusion destroys the RAM, which is often the only place where what has happened is still visible.
Affected passwords and keys are changed - Also those that are shared with other systems.
Active sessions and mandates are withdrawn - A change of password shall not terminate a session or access authorisation already issued.
Known entry routes are blocked at network border - And the lock is written down to cancel it later.
Checking for adjacent systems - One compromised machine is rarely the only one.
The change made during each incident is recorded in time - Without it, in three days no one knows what was changed and what can be returned.
It is decided whether the attacker block immediately or observe - Observation gives information but extends access. This choice is made consciously, not by chance.

5. Evidence and investigation

Drive and memory image created before cleaning - Cleaning is irreversible, creating an image is not.
Logs are saved outside the affected system - The attacker in the system can delete them.
The evidence chain is documented - Who took it, when, where it stored it and what access it had.
The investigation shall take place with a copy, not with the original - The original remains untouched in the case of legal proceedings.
Searching for initial entry path, not only consequences - Prevented effects without a avoided cause is a repeat incident.
What data and systems are affected - Without scale, you can neither report accurately nor inform affected people.
Logs are kept long enough for an incident to be investigated - Entry is often detected months after it occurred.

6. Eradication and restoration

The cause is eliminated before the system returns to work - Otherwise the renewed system is compromised along the same path.
Renewal takes place from a copy known to be clean - A copy created after entering may contain the same access.
Update of backup has been verified in advance - A copy that has not been updated is not a copy.
Backup not achievable from daily working environment - The data encryption attack first looks for exactly those.
The renewal sequence is defined by the importance of the service - Otherwise, what is easier to restore is first returned, not what is needed.
The system is tested before returning to work - Both the action and the fact that the attacker has no access anymore.
Post-return monitoring is reinforced for a limited period of time - The attacker often tries to return along the same path.

7. Reporting and communication

Early warning for a significant incident is sent within 24 hours - The addressee is the competent cyber incident prevention body and the form is signed with a secure electronic signature.
Initial report is submitted within 72 hours - It's another report and another form, not an early warning repeat.
The final report is submitted within one month - If the incident is not resolved so quickly, a progress report and a final report after resolution shall be submitted first.
A minor incident is reported free of charge - The threshold is not reached, but the reporting obligation remains.
If personal data are affected, the Data State Inspectorate is informed within 72 hours - A separate addressee and a separate obligation, not the same message.
Affected people and customers are informed when the incident affects them - By what they can do themselves, not only by the fact that something happened.
Communication during an incident takes place through a channel outside the affected environment - If the attacker reads email, the plan is discussed in his presence.
One speaker has been prepared for public communication - A draft notice saves hours just when it is not.

8. Post-incident training

After the incident, consultation takes place within a specified deadline - While the details are still remembered, not during the quarterly report.
The incident is added to the outcome and cost register - Cost is the argument that confirms the next improvement.
The plan is corrected where it failed - Unchanged plan after the incident means that there was no training.
Specific changes in controls with responsible and time-limit resulting from an incident - Discussion without a task is a conversation.
Response is trained on a fictional scenario at least once a year - The first time must not coincide with a real incident.
Contact list and access checked after each training - An outdated number is just when you call it.
Time from discovery to containment is measured - A number that doesn't change shows that training doesn't change anything.