Preparation and Incident Response Planning
Building readiness before the incident
Preparation is where IR succeeds or fails. A credible program includes a written IR plan (policy, scope, authority, escalation), playbooks/runbooks for common scenarios (ransomware, phishing, insider, DDoS), and communication plans with pre-approved templates and contact trees. Candidates must understand the hierarchy: policy → plan → procedures/playbooks.
Concepts to master
- Asset inventory and criticality tiers: you cannot prioritize response without knowing what matters most.
- Baselines and logging: centralized, time-synchronized logs (NTP), retention periods, and known-good configurations enable detection.
- Tabletop exercises and simulations: validate the plan, roles, and communications before a real event. Distinguish tabletop (discussion) from functional/full-scale (live execution).
- Retainer and vendor agreements: forensics, IR, PR, and legal counsel arranged in advance.
- Out-of-band communications: assume primary email/chat may be compromised.
- Jump bag and evidence kit: write blockers, clean media, hashing tools, chain-of-custody forms.
Traps in questions
Questions love to test whether preparation includes testing. A plan that is written but never exercised is a documented gap. Another trap: confusing preventive controls (firewalls, patching) with preparedness activities (playbooks, drills). Also watch for the assumption that the plan is static - it must be reviewed and updated after exercises and real incidents.
Rule of thumb
If a question describes an activity done before an incident to enable response, it belongs to Preparation - including training, tooling, agreements, and exercises.