Boardroom Forum invitations open this summer
About Search FAQ
IRC Incident Response Consortium Est. 2017 Join the community
About Forums Boardroom Forum Practitioner Forum Partners Forum Events Past events Past Presentations Resources Playbook Policy Engine Books and frameworks Useful links Job board Document library Breach Budget Game Practitioner Runbooks Blog Training Learning paths Mentor matching Partners disclosure Membership tiers FAQ Contact Join the community →
Home/Resources/Books and frameworks

Recommended reading.

The IR books, frameworks and references that members keep coming back to. Curated by the Editorial Committee, updated annually.

Recommended books

Three foundations worth the shelf space.

Book one · MITRE
Free download
Ten Strategies of a World-Class Cybersecurity Operations Center

Ten Strategies of a World-Class Cybersecurity Operations Center

Today's cybersecurity operations center (CSOC) should have everything it needs to mount a competent defense of the ever-changing IT enterprise. This includes detection and prevention technologies, a sea of cyber intelligence reporting, and a rapidly expanding workforce. Yet most CSOCs continue to fall short in keeping the adversary, even the unsophisticated one, out of the enterprise. This is the MITRE practitioner's guide on how to fix that.

Download the PDF Order a hard copy
Book two · Wiley
Hard copy
Cybersecurity for Executives: A Practical Guide

Cybersecurity for Executives: A Practical Guide

Gregory J. Touhill's practical guide. Written in plain language, the book explains how to recognise and act on cybersecurity threats to protect a business, how to manage risk, and how to recover when a cyber incident occurs. Gives executives the language needed to integrate cybersecurity into business decision-making, with metrics to protect the bottom line and decisive actions to mitigate and recover.

Order a hard copy
Book three · GMU
Free download
Improving Social Maturity of Cybersecurity Incident Response Teams

Improving Social Maturity of Cybersecurity Incident Response Teams

The technological edge enjoyed by organisations in developed nations is diminishing as the world further integrates its knowledge. Technology enjoys pride of place in any cybersecurity conversation, but it is only part of the solution. Real-time cybersecurity relies on the people behind the technology. Because incident response increasingly requires collective action, this creates an entirely new paradigm. George Mason University's research-driven handbook on the social maturity of IR teams.

Download the PDF
Frameworks

The reference standards we point members at.

Not every framework is worth your time. These are the ones members rely on, and the ones we cite in our own Playbooks and Practitioner Runbooks.

NIST SP 800-61r2

Computer Security Incident Handling Guide. The foundational US framework. Preparation, Detection and Analysis, Containment, Eradication and Recovery, Post-Incident Activity.

Read the guide →

ISO/IEC 27035

Information security incident management. The ISO multi-part standard covering principles, guidelines, and the planning and preparation for incident response.

Read the standard →

SANS Incident Handler's Handbook

The practitioner's reference. Six-phase IR methodology that maps cleanly to NIST and ISO but is written for the people doing the work.

Read the handbook →

CISA Incident Response Playbooks

The US Cybersecurity and Infrastructure Security Agency federal civilian executive branch playbooks for incident and vulnerability response. Useful even outside the public sector.

Open the CISA playbooks →

Missing a book or framework that should be on this list? Tell us. Submissions to hello@incidentresponse.com.

Back to Resources
Newsletter

One email a month. No filler.

Community calls coming up, new resources published, and what we're seeing across the membership.

One email a month. Unsubscribe any time. Read our privacy notice.