Security Policies and Procedures for Incident Response
This domain tests process discipline: whether you can run an incident inside a documented plan, preserve evidence that survives scrutiny, meet notification obligations, and measure improvement. Expect scenario questions where the technically obvious action is procedurally wrong.
The response lifecycle
NIST SP 800-61 structures response as preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Playbooks exist per scenario (ransomware, business email compromise, insider data theft) and define roles: incident commander, communications lead, legal, and technical handlers. A severity matrix and escalation path must be agreed before an incident, not during one. The NIST Cybersecurity Framework functions (Identify, Protect, Detect, Respond, Recover, plus Govern in CSF 2.0) provide the program-level view.
Evidence handling
Follow the RFC 3227 order of volatility: registers and cache, memory, temporary file systems, network state, running processes, disk, logs, backups, archives. Chain of custody requires an unbroken record of who handled the evidence, when, where and why; SHA-256 hashes at acquisition and verification; write blockers; and working on verified copies while originals stay in controlled storage. Legal obligations are time-bound: GDPR requires notifying the supervisory authority within 72 hours of becoming aware of a qualifying breach, and PCI DSS requires a documented incident response plan (requirement 12.10). 'Awareness' means discovery, not the end of the forensic investigation.
Worked example
At 02:00 ransomware is found on a finance workstation with mapped file shares. Reasoning: classify as top severity, then contain before cleaning - isolate the endpoint through the console, which keeps management access, rather than powering it off and losing memory. Capture volatile data and hash the ransom note and encryptor before any wipe. Disable the compromised account and check whether shares show encryption activity. Timestamp everything in UTC, open a bridge with legal and communications, and log the discovery time because it starts the notification clock. Preserve the image, rebuild, restore from a backup verified clean, then run a post-incident review that assigns owners and due dates.
Traps that cost marks
- Pulling the power or rebooting before capturing memory.
- Reimaging a host without imaging it first, destroying the evidence.
- Starting the GDPR clock at the end of the investigation instead of at awareness.
- Letting the discovering analyst be sole custodian, removing dual control.