Incident Response Plan Essay

An incident response plan is a must for any business that uses a network made of computers, hand-held, and servers. If you have a network your business is susceptible to man made attacks and natural disasters The Incident response (IR) plan helps to mitigate the risks and damage and minimize downtime. For an IR plan to be successful, the business needs to follow nine steps.

The first step is to address business issues and assign roles to team members. These team members need to be people who own and maintain the documentation. There needs to be documentation of what constitutes an attack and how to remedy that attack. UC Berkley accomplishes this step by assigning a member to annually draft a list of names and contact information for their team members. They also have it spelled out how to respond and report to certain

UC Berkley’s IR guideline doesn’t show what departments they have involved in their plan. It does provide titles for different people on the team. Just as long as you have the important teams needed to have your IR to succeed and they know who they are should be fine.

The third step to a successful IR plan is identifying key performance indicators. (KPI) This can include the time to detection, reporting an incident, and investigation. The nature of the attack and the security tool used to spot the threat could also be labeled as KPI’s.

The fourth step should be making sure the IR plan is tested before it’s needed. This test should include everyone involved when a real activation is made and simulate a real breach.

The next step should be constant reviewing of the plan. No plan will stay the same from year to year. With the growth of a business and the never-ending change in technology. Businesses need to make sure they are adapting to these changes. Part of that is making sure their IR plan is changed constantly to reflect these