Incident Response Plan
Identifies organisation-specific incident response plans with named role assignments, severity definitions or contact details. Plan titles alone are discovery-only.
- Type
- regex
- Confidence
- medium
- Confidence justification
- Medium confidence: titles are discovery-only; enforcement requires named roles, severity rows or contacts, and 85 adds a second structure and IR-phase context.
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, SOC 2
- Data categories
- security, technology
- Scope
- narrow
- Risk rating
- 8
Should match
Cyber security incident response plan - Harbourside Council (v2.1) Incident commander: Priya Ellison SOC lead: Mei Tanaka, soc-duty@harbourside.example.internal, phone 07 5550 1234 SEV1: confirmed ransomware or data exfiltration - page the incident commander within 15 minutes SEV2: contained malware on a single endpoint Containment: isolate affected hosts; preserve a forensic image before rebuild.— High tier (85) - named roles, contact details and severity rows with containment/forensic contextIncident response plan, section 3 - Incident manager: Jordan Blake is accountable for decisions during an incident.— Medium tier (75) - named role assignment onlyIncident response procedure severity table - P1 (Critical): customer-facing outage or confirmed breach.— Medium tier (75) - severity definition onlyThe incident response plan was exercised in a tabletop session last quarter.— Discovery tier (65) - plan title only
Should not match
Agencies should maintain a cyber security incident response plan that names an incident manager and defines severity levels.— Guidance textIncident response plan template Incident commander: ________ Phone: ________ SEV1: ________— Blank templatePress release: the hospital activated its incident response plan after a ransomware attack, a spokesperson said.— News framingTraining module: students write an incident response plan with Incident commander: Alex Smith and SEV1: outage.— Training framing with populated fields must not enforce
Known false positives
- Generic incident references, IR guidance (e.g. NIST SP 800-61) and news about organisations activating their plans. Mitigation: Plan titles are discovery-only; enforcement needs named role assignments, severity rows or contacts, and guidance/training/news/template framing is excluded.