Crafting Your Incident Runbook

An incident management runbook is a comprehensive document that outlines procedures and instructions for specific incident scenarios. It is an extension of the organization’s incident management policies and procedures. While policies outline overarching cybersecurity goals, strategies, and guidelines, procedures define the exact steps to be executed to achieve the goals set by security policies. Runbooks compile related procedures, detailed workflows, additional resources, and information to manage specific incident scenarios effectively. This can include cyber incidents or physical incidents that may impact a company’s operations, assets, or reputation.

A runbook is a living document that is updated most frequently, including cybersecurity and overall information security documents. The greatest benefit of having well-documented and up-to-date runbooks is that it alleviates stress and opportunities for error during incident response. Teams responding to incidents may have yet to have the opportunity to agree with all responsible decision-makers on what steps should be taken, what should be prioritized, and what should be communicated during and after the incident. Runbooks provide clear steps to follow and to ensure everyone is on the same page during the incident response.

Here is a checklist to help you plan, document, and maintain an effective incident management runbook.

Runbook Outline

Company Overview

This should include a brief introduction of the company’s operations, mission statement, vision, key services, security strategy, compliance requirements, and organizational structure.

Purpose of the Runbook

The purpose outlines the primary goal of the runbook, why it was created, who it is for, and how it will be used during an incident response.

Scope of the Runbook

The scope defines and clarifies the process scenarios the runbook covers. That includes the types of incidents covered by the runbook and what is included and excluded.

Roles and Responsibilities

List the key roles of everyone involved in the incident response to ensure clear accountability and clarity during the incident response. This should include key stakeholders and their roles, specifically during the incident response.

• Key incident response team
  • Lead incident response efforts (e.g., Incident Manager)
  • Coordinate communication and actions (e.g., Incident Manager)
  • Provide Technical Support (e.g., IT Support Team)
  • Assist in the containment and eradication process (e.g., IT Support Team)
  • Manage Internal and External Communication (e.g., Communications Team)
  • Handle Public relations as needed (e.g., Communications Team)
  • Specific duties based on expertise (e.g., forensic analysis, threat intelligence, limited system access)
• Key stakeholders (internal and external)
• Decision makers and approvers
• Legal and compliance team

Incident Detection and Identification

Outline methods or tools that may be used for detecting scoped incidents and procedures for triaging and reporting such incidents. This should have clear instructions on appropriate reporting channels, escalation procedures, and incident classification criteria based on severity and impact on business operations. Reporting should account for user-reported incidents as well as automated alerts from security monitoring tools (SIEM, IDS/IPS, endpoint protection, etc.). Incident classification should provide examples of incident types that fall within the scope of the runbook.

Steps to Follow

This is a core section of the runbook. It includes detailed step-by-step instructions to be followed—a guide and outline of the incident response procedures and actions to be taken during the incident response. This should be organized based on the main incident response phases: preparation, detection and analysis, containment, eradication, recovery, and documentation, along with post-incident analysis and reporting steps.

• Detection - confirming that the identified event is, in fact, an incident, and steps for initial triage to assess the impact.
• Containment - steps for immediate actions to limit the spreat, containment strategy based on the incident type and evidence collection may be required for further analysis, compliance and legal requirements.
• Eradication - removal of the identified root cause of the incident to ensure complete removal of the threat.
• Recovery - steps for system restoration to the normal operation state, validation of system integrity and functionality.
• Documentation and Reporting - the reporting procedure should outline the system used for incident documentation, requirements for reporting per regulatory bodies, and incident tracking during investigation, containment, eradication, recovery steps, and post-incident analysis, along with lessons learned.

Communication Plan

A communication plan is a set of clear instructions for internal and external communication strategies. This should include channels used for each, highlight responsible internal and external stakeholders and their contact information, clear step-by-step escalation process, response time expectations, and reporting protocols.

• Internal communication should include communication channels for the incident response team, notification procedures for affected users and departments, and regular communication updates during the incident for all affected teams and management.
• External communication should include guidelines for communication with customers, partners, vendors, media, regulatory and legal notification requirements, and communication protocols for each. The most crucial aspect is to outline what type of information can be communicated externally, how, when, and who. Ideally, pre-approved templates for external and internal communication should be part of the runbook preparation and accessible to the individuals or teams responsible for communication.

Tools and Resources

Include a list of tools and resources to be used during the incident response. This can include reference to related procedures, pre-approved tools, outsourced incident management services (e.g., digital forensics), partner or vendor contact information, and designated support channel guidelines for each.

Post Incident Steps

Outline detailed instructions for post-incident activity: review, analysis, debriefing, documentation, and continuous improvements to the runbook to prevent any experienced issues during incident response. This should include post-incident analysis, lessons learned, and recommendations for future enhancements to the runbook and incident response process.