Security Incident Response Playbook

Type: {{ incident_type }} Description: {{ incident_description }} Affected Systems: {{ affected_systems }}

CRITICAL: Security Incident Differs from Operational Incident

• Preserve evidence — do not destroy logs, do not reimage systems without forensic capture
• Limit communication — use secure channels, need-to-know basis only
• Legal involvement — notify legal counsel early for breach/data exposure events
• Regulatory obligations — data breaches may have mandatory notification timelines

Phase 1 — Detection and Triage (0-15 min)