Personal — In Progress

Incident Response Playbook (SOC)

Structured incident response procedures for malware, ransomware, data breaches, phishing, and unauthorized access

Context

This playbook builds on and extends incident-response-playbook, an open-source repository of incident response procedures. Goal: a set of structured procedures for the 6 most common cybersecurity threats, designed for SOC teams and IT admins at SMBs and mid-market companies alike — beyond theory, with documents a team can actually use.

6 available playbooks

P01 — Malware infection (High to Critical severity)
P02 — Ransomware attack (Critical)
P03 — Data breach (High to Critical)
P04 — Phishing (Medium to High)
P05 — Unauthorized access (High to Critical)
P06 — Denial of service, DoS/DDoS (Medium to Critical) — playbook added on top of the original

Incident response lifecycle

Every playbook follows the same cycle: Detection → Triage → Containment → Eradication → Recovery → Lessons Learned, with concrete, checkable actions as checklists — not a theoretical description of the NIST SP 800-61 process, but documents actually usable during a live response.

How to use this playbook

Identify the incident type using the severity matrix
Open the matching playbook and follow the steps in order
Check the RACI matrix to know who does what
Document every action in real time with the incident report
Escalate per the defined escalation procedures
Communicate internally/externally with the crisis communication template
Capitalize on lessons learned with the post-mortem

Outcomes

Playbooks: 6(Malware, ransomware, data breach, phishing, unauthorized access, denial of service)
Supporting deliverables: RACI matrix + crisis communication template(Added on top of the original)
Framework: NIST SP 800-61(Detection → Containment → Eradication → Recovery cycle)
Target audience: SOC & IT admin teams(SMB to mid-market)