CISA Cybersecurity Incident Response Playbook - Episode 2 - Preparation Phase

This series takes a look at the Cybersecurity and Infrastructure Incident Response and Vulnerability playbook. This playbook, released in November 2021, provides an outline of how all FCEB agencies should implement their incident response plans. This eight-episode series will look at each section of the playbook and break out the important considerations for each.

In the second episode of the series, we break down the Preparation Phase of the playbook. We address the three P’s of Preparation: Policy, Procedure, and People and the associated tasks and responsibilities for each of those. Are you documenting cyber threat intelligence? Training your incident response teams, and frequently testing SOAR, SIEM, and Forensic software and Hardware? You should!

Resources:

Cyber Security Incident & Vulnerability Response Playbooks - CISA, November 2021

Improving the Nation’s Cyber Security. - Executive Order 14028, May 2021

Computer Security Incident Handling Guide. - NIST 800-61 rev2, August 2012

Zero Trust Architecture - NIST 800-207, August 2020