Cyber Incident Response Plan

Ruslan Rakhmetov, Security Vision

Today, no company – not even the most advanced and well-protected one – is immune to cyberattacks. Therefore, minimizing damage from virtually inevitable breaches has become a top priority. Without regulated incident response processes, a cyber incident can lead to chaos, poor decision-making, and untimely actions, ultimately exacerbating negative consequences. This article focuses on developing incident response plans: we will examine applicable methodologies and standards, provide recommendations for creating response scenarios, and discuss practical aspects of countering attackers.

As we noted in the previous article , a cyber incident is a detected change in the state of IT infrastructure elements, indicating the successful implementation of an information security threat and a breach of information security. Obviously, it's logical to prevent a cyber incident –the application of preventative, prescriptive, and proactive security measures should prevent the threat from materializing. But what if attackers have bypassed protective measures, discovered vulnerabilities (technical or organizational), attacked the supply chain, used social engineering methods, or even implanted an insider? Signs of a cyber incident must be detected as quickly as possible, the attacked assets must be identified, the incident characteristics must be analyzed, and response measures must be prioritized . Then, the incident must be contained and remediated, the infrastructure restored, and any disrupted business processes restarted. To systematize and streamline response actions, preparatory work must be carried out, starting wisely with an analysis of applicable methodologies, frameworks, and standards.

Russia has a number of standards in place for responding to cyber incidents and monitoring cybersecurity:

• GOST R 59709-2022 "Information Security. Computer Incident Management. Terms and Definitions";

• GOST R 59710-2022 "Information protection. Computer incident management. General provisions";

• GOST R 59711-2022 "Information protection. Computer incident management. Organization of computer incident management activities";

• GOST R 59712-2022 "Information Security. Computer Incident Management. Guidelines for Response to Computer Incidents";

• GOST R 59547-2021 "Information Protection. Information Security Monitoring. General Provisions";

• GOST R 59548-2022 "Information Security. Registration of Security Events. Requirements for Registered Information."

GOST R 59709-59712 standards are intended for use by GosSOPKA (i.e., critical information infrastructure entities, participants in information exchange with GosSOPKA , GosSOPKA Centers, and the National Coordination Center for Computer Intelligence) but can also be used by other organizations as methodological documents and best practices. GOST R 59709-2022 provides a number of definitions: in particular, an information security incident is defined as an unexpected or undesirable event (group of events) in information security that has led or may lead to a disruption of an information resource, the emergence of information security threats, or the violation of information security requirements. The authors of the standard also distinguish between the concepts of "information security incident," "computer incident," and "computer attack."

• computer incidents are a subset of information security incidents for which the fact of malicious impact or termination (disruption) of the functioning of protected information resources has already been confirmed;

• a computer attack is a targeted malicious action;

• a computer incident can be caused by a computer attack, technological disruptions, human error, or equipment failure.

The GOST R 59710-2022 standard states that computer incident management includes four stages:

     - organization of computer incident management activities;

     - detection and registration of computer incidents;

     - response to computer incidents (including recording materials related to the occurrence of computer incidents and establishing the causes and conditions of the occurrence of computer incidents);

     - analysis of the results of computer incident management activities.

The first stage is described in the standard GOST R 59711-2022, and the next three stages are described in GOST R 59712-2022.

Let's turn to the standard GOST R 59711-2022, which states that the following steps must be taken to organize the computer incident management process:

     - develop a computer incident management policy;

     - develop a computer incident response plan;

     - identify the unit responsible for managing computer incidents;

     - organize interaction with departments within the company and with external organizations;

     - provide resources (equipment, people, budget) to the unit responsible for incident management;

     - organize training and information for responsible persons and employees of the organization in terms of managing computer incidents (including conducting briefings on a regular basis);

     - organize regular training sessions to practice the computer incident response plan, which can be conducted in the form of discussions, team training sessions (command-staff cyber exercises), and practical exercises.

The GOST R 59711-2022 standard states that a computer incident management policy is a high-level document and must contain:

     - objectives of computer incident management activities;

     - information about the resources in relation to which computer incident management activities will be carried out (area of responsibility);

     - general information about what constitutes a computer incident for an organization (this information is used to develop rules for identifying incidents and confirming them);

     - a high-level overview or visualization of the computer incident management process in terms of the "detection and registration of computer incidents" and "response to computer incidents" stages;

     - a description of the organizational structure of the unit responsible for managing computer incidents, including the roles of the unit's specialists, their duties and powers.

In accordance with the provisions of GOST R 59711-2022, a computer incident response plan must contain detailed step-by-step instructions for actions performed during the "detection and registration of computer incidents" and "response to computer incidents" stages, taking into account the specifics of the company and its infrastructure, as well as the types, priorities, and impact levels of incidents. Specifically, a computer incident response plan must include:

1. General information required for detecting, recording and responding to computer incidents:

1.1. technical characteristics and composition of the company’s controlled information resources;

1.2. a list of types of detected and recorded computer incidents, indicating their priorities, levels of impact, methods of detection and recording;

1.3. the procedure for forming the composition of working groups to respond to computer incidents;

1.4. list of persons involved in the response, their functions and responsibilities;

1.5. procedure for access to monitoring data and to information on the progress of the response;

1.6. established deadlines for completing the response stages;

1.7. the procedure for registering actions performed at the "response to computer incidents" stage (i.e. logging the actions performed during the response);

Optional:

1.8. the procedure for making a decision on the need to involve specialists from the National Coordination Centre for Critical Injuries in the response;

1.9. the procedure for conducting measures to respond to computer incidents jointly with the National Coordination Center for Cybersecurity.

2. The procedure for detecting and registering computer incidents:

2.1. list and description of rules for registering signs of possible computer incidents (list of information security events, monitoring data, conditions and correlation rules);

2.2. the procedure for receiving information about signs of possible incidents from employees of the organization;

2.3. procedure for verifying the facts of computer incidents;

2.4. forms of computer incident cards;

2.5. list and forms of reports generated at the stages of "detection and registration of computer incidents" and "response to computer incidents".

3. Procedure for responding to computer incidents:

3.1. the procedure for determining the elements of the information infrastructure involved in a computer incident;

3.2. procedure for localizing computer incidents;

3.3. situations in which it is necessary to stop actions to respond to a computer incident;

3.4. the procedure for monitoring the response process by those responsible and managers;

3.5. the procedure for identifying and eliminating the consequences of computer incidents;

3.6. procedure for closing computer incidents;

3.7. the procedure for recording materials related to the occurrence of computer incidents (incident artifacts, digital evidence, computer forensics data), the procedure for establishing the causes and conditions of the occurrence of computer incidents.

In addition, appendices A and B to the standard GOST R 59711-2022 provide principles for determining the levels of impact of computer incidents (using the indicators of the criteria for the significance of critical information infrastructure objects in accordance with PP-127), the procedure for determining the priority of incidents (depending on the significance of the affected infrastructure elements and the scale of the incident), and the procedure for determining the order of response to incidents (depending on the level of impact and priority of the incident).

Finally, the standard GOST R 59712-2022 defines the content of three stages of computer incident management:

1. Detection and registration of computer incidents:

1.1. registration of signs of possible computer incidents;

1.2. confirmation of computer incidents.

2. Response to computer incidents:

2.1. identification of the elements of the information infrastructure involved in the computer incident;

2.2. localization of a computer incident;

2.3. identification of the consequences of a computer incident;

2.4. elimination of the consequences of a computer incident;

2.5. closure of a computer incident;

2.6. recording materials related to the occurrence of a computer incident;

2.7. establishing the causes and conditions of the computer incident.

3. Analysis of the results of computer incident management activities:

3.1. acquisition and accumulation of experience based on the results of computer incident management;

3.2. development of recommendations for eliminating the causes and conditions for the occurrence of computer incidents in information resources;

3.3. evaluation of the results and effectiveness of response to computer incidents.

It should also be noted that for owners of critical information infrastructure facilities, the Order of the Federal Security Service of Russia No. 547 of December 25, 2025, "On Approval of the Procedure for Notifying the Federal Security Service of Russia about Computer Attacks and Computer Incidents, Responses to Them, and Taking Measures to Eliminate the Consequences of Computer Attacks..." is applicable. This document states that a critical information infrastructure facility must develop a plan for responding to computer incidents and taking measures to eliminate the consequences of computer attacks. This response plan must include:

     - technical characteristics and composition of significant objects of critical information infrastructure;

     - events (conditions) upon the occurrence of which the implementation of the measures provided for in the response plan begins;

     - activities carried out during the response to computer incidents and the adoption of measures to eliminate the consequences of computer attacks, as well as the time allocated for their implementation;

     - a description of the composition of the departments and officials of the critical information infrastructure entity responsible for implementing measures to respond to computer incidents and taking measures to eliminate the consequences of computer attacks;

Optional:

     - conditions for the involvement of units and officials of the FSB of Russia in conducting activities to respond to computer incidents and taking measures to eliminate the consequences of computer attacks;

     - the procedure for the owner of a significant critical information infrastructure facility to carry out measures to respond to and eliminate the consequences together with the involved units and officials of the FSB of Russia.

In addition, Order No. 547 states that owners of critical information infrastructure facilities must perform the following actions when responding to incidents and eliminating the consequences:

     - analysis of computer incidents (including determining the order of response to them), establishing their connection with computer attacks;

     - carrying out activities in accordance with the response plan;

     - determination, in accordance with the response plan, of the need to involve units and officials of the FSB of Russia and the Bank of Russia in responding to computer incidents and taking measures to eliminate the consequences of computer attacks.

Let's now turn to international practice. Among the most interesting and practically useful methodologies and frameworks for cyber incident management are the following documents:

1) The PICERL methodology from the American professional information security certification organization SANS Institute was developed on the basis of a publication on incident management ("Incident Handler's Handbook"). PICERL is an acronym for the incident management phases listed in the document: Preparation , Identification , Containment , Eradication , Recovery , Lessons Learned (lessons learned).

2) Recommendations for responding to cyber incidents are also provided by the American institute NIST in a special publication NIST SP 800-61 Rev.3 "Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile". Unlike the previous version of this document (Rev. 2), which has been actively used by information security professionals since 2012, the new version of the publication is oriented towards compliance with the NIST CFS 2.0 framework and focuses on integrating response processes into the overall corporate information security management system. The response lifecycle model consists of the phases of preparation (related to the functions of identifying and managing cyber risks, implementing protective measures), incident response (identifying and analyzing attacks and compromises, performing response actions, restoring assets and operations affected by the incident), and lessons learned analysis (improving processes).

3) The ISO/IEC 27035 group of standards is dedicated to information security incident management and includes the documents ISO/IEC 27035-1:2023 ("Principles and processes"), ISO/IEC 27035-2:2023 ("Guidelines for planning and preparing for incident response"), ISO/IEC 27035-3:2020 ("Guidelines for information and computer technology incident response operations"), ISO/IEC 27035-4:2024 ("Coordination").

Let's take a closer look at the ISO/IEC 27035-3:2020 standard , which describes the following processes within the framework of cyber incident response:

I. The process of detecting and recording cyber incidents.

1. Collection of information about information security events and other information security monitoring data from various sources: data from information security systems, IT systems, as well as messages from employees, counterparties, suppliers, contractors, and clients.

2. Registration of information security incidents: manually by the responsible person or automatically in the information security system.

3. Primary analysis: determining the sufficiency of information, collecting additional information, enriching and contextualizing incident data.

4. Prioritization (criticality assessment), categorization (triage) of an information security incident, filling out an information security incident card.

5. Sending notifications to employees included in the response team.

II. Computer incident response process.

1. Localization of a computer incident:

Goals:

• Prevent violation of confidentiality, integrity, and availability of information;

• Prevent further unauthorized actions by attackers;

• Prevent lateral movement and spread of the threat to other elements of the IT infrastructure.

Methods:

• Blocking IP addresses, domains, and URLs attacking network information security systems (firewalls, proxy servers);

• Network isolation of the attacked host (on network equipment or by means of host information security systems);

• Disabling compromised accounts;

• Disabling processes, services;

• Turning off the device (may hinder further investigation and forensics).

2. Identifying the consequences of a computer incident:

Goals:

• Identify signs of the negative impact of an information security incident on the infrastructure (for example, suspicious network activity and processes, changes in software composition, changes in files, abnormal behavior of the device);

• Assess the level of negative impact of an information security incident on the infrastructure (labor costs, infrastructure downtime, assessment of harm and financial damage).

Methods:

• Processing data from host and network information security systems on a compromised device;

• Manual expert actions using available information sources.

3. Elimination of the consequences of a computer incident:

Goals:

• Elimination of the consequences of a computer incident;

• Restoring compromised objects to their pre-attack state.

Methods:

• Reconfiguration of software/OS to comply with information security policies;

• Recovering data and software/OS from backup copies;

• Reinstall software/OS from a trusted source, install the latest version and all security updates;

• Connection of backup resources (communication channels, server equipment, virtual machines, spare components);

• Making changes to the IT infrastructure architecture;

• Migration of virtual machines to backup infrastructures.

4. Closing a computer incident:

This step is performed after all previous actions have been completed, provided the measures taken are sufficient and the completeness of the measures implemented has been assessed by the head of the information security incident management unit. If the measures taken are assessed as insufficient, the previous steps are returned to and the corresponding actions are repeated.

III. Establishing the causes of computer incidents.

Target:

• Determination of factors that caused or contributed to the occurrence of an information security incident.

Methods:

• Analysis of user actions, their compliance with information security policies;

• Analysis of security event logs of OS, software, information security tools, network equipment;

• Analysis of a copy of network traffic and information about connections of the compromised device and the source of the attack;

• Analysis of device status data (running processes, network connections, active user sessions, registry status, file system status);

• Analysis of the configuration of OS, software, information security tools, network equipment, hardware;

• Analysis of security assessment results, presence of vulnerabilities, penetration test results;

• Reverse engineering of suspicious objects, studying them in a sandbox.

IV. Analysis of the results of information security incident management activities (“post-analysis”).

Goals:

• Acquisition and accumulation of experience based on the results of information security incident management

• Evaluation of the results and effectiveness of response to information security incidents

• Updating the information security management system

• Updating the information security incident management policy and the information security incident response plan

After reviewing the above methodology and guidelines, the following list of necessary documents for ensuring response to information security incidents can be compiled:

• A response policy is a high-level document that describes the principles and approaches to incident management in a company;

• A response plan and procedures (or playbooks /response scenarios) are developed for each of the relevant types of incidents and contain practical steps and instructions when certain types of incidents occur (e.g. DDoS , phishing, malicious activity, unauthorized access, etc.);

• Instructions for those responsible - a detailed description of the technical operations when performing certain actions as part of the response (for example, commands for obtaining the properties of an attacked account, a description of creating a blocking network rule on the firewall, a description of moving a device to a network quarantine group, collecting artifacts on the attacked device, etc.);

• escalation matrix – a document describing the conditions under which the level of responsibility increases when responding to an incident (for example, an employee at L1 can escalate an incident to an employee at L2, an employee at L2 to level L3, and from L3 the incident can be escalated even higher – to a cyber forensic expert , a reverse engineer, or to specialized organizations);

• Incident communication matrix – a document describing with whom and how to interact during an incident (the person responsible for the asset/process, the owner of the asset/process, the company management, the IT department, security, lawyers, PR, GR, etc.).

To summarize the above, we can offer a number of practical recommendations for improving the effectiveness of cyber incident response:

1. It's impossible to create universal response scenarios that will suit every company. The scale of the infrastructure, the specifics of business processes, the technologies used, applicable regulatory requirements, and resource and financial constraints must be taken into account. However, when developing response scenarios, it is possible and appropriate to draw on the work of the information security community. For example, the following playbook templates can be used as a source of ideas:

https://gitlab.com/syntax-ir/playbooks

https://github.com/certsocietegenerale/IRM/tree/main/EN

https://learn.microsoft.com/en-us/security/operations/incident-response-playbooks

https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks

https://github.com/luduslibrum/awesome-playbooks

2. The most important stages of response are preparation and analysis of lessons learned: without thorough preparation with practical training and drills, it is impossible to effectively carry out all actions when a cyber incident occurs, and without analyzing the causes of the incident, assessing the completeness and consistency of the actions taken, developing a list of countermeasures and security improvements, similar incidents will recur again and again.

3. Response processes should be linked to other cybersecurity processes – for example, without high-quality asset and vulnerability management, it is impossible to organize a response, and without a connection to the continuity and recovery process, it will be impossible to launch the infrastructure in a timely manner after an incident.

4. It is essential to understand modern tactics, techniques, and tools used by attackers – response scenarios require continuous updating not only based on the results of incident processing, but also as new cyberattack methods emerge.

5. Modern cyberattacks occur at extremely high speed – attacks are automated, employing swarms of AI agents, and attackers actively cooperate with each other to increase the effectiveness of hacks. Without automation, defenders will be unable to provide an adequate response and will always be one step behind attackers. That's why we at Security Vision develop solutions to automate cyber incident response and robotize cybersecurity processes. We use AI to enhance analyst expertise and reduce routine workloads, utilize dynamic response scenarios that adapt to the context of a specific incident, create a unified resource and service infrastructure model, and enable maximum flexibility in customizing workflows using a convenient Low-Code / No-Code designer. To automate cyber incident response, our customers can use Security Vision products such as:

• Security Vision SOAR and NG SOAR

• Security Vision SIEM

• Security Vision TIP

• Security Vision UEBA

• Security Vision CMDB

• Security Vision VM

• Security Vision VS