The purpose of a security playbook is to give all members of an organisation a clear understanding of their responsibilities before, during, and after a security incident.
Key action steps include:
- Incident detection
- Response actions
- Communication
The team
The IR team needs to be in place prior to an incident:
CEO/CTO: reacts to malicious messages and communicates with the board.
IT Department: the technical leader puts input on the plan, but cannot be solely responsible.
Communications/PR: deals with potential media coverage.
Legal Counsel: ensures the IR meets compliance and regulatory requirements.
Drilling the plan
Establish a step by step plan. Drills and exercises help find weaknesses sooner. The team has to react fast. Quick and effective reaction reduces impact and cost.
Originally published 12 June 2017. Migrated to the new IRC site in 2026.