Incident Management

Authored by:

Dickson Wu

SEAL

Incident management involves preparing for, detecting, responding to, and recovering from security incidents. By thinking about incident management prior to actually experiencing an incident, you can help increase the likelihood of a timely recovery.

This section contains two different kinds of content:

• Framework guidance: explanatory pages on communication, detection/response, lessons learned, and reference playbooks
• Operational templates: copy-and-adapt incident response documents, templates, and runbooks for internal team use

Use the framework guidance to understand the discipline. Use the incident response template section to build your own operational documentation.

Contents

1. Communication Strategies
2. Incident Detection and Response
3. Lessons Learned
4. Playbooks
5. SEAL 911 War Room Guidelines
6. Incident Response Template