Incident response¶

An organisation without a security team or a SIEM still has security incidents. The incidents do not wait for the infrastructure to be ready. A compromised account, a data breach via a phishing attack, ransomware via a malicious attachment, an employee who accidentally shared a donor spreadsheet publicly: these happen regardless of whether a formal incident response programme exists.

The goal at this stage is not a mature incident response capability with runbooks and a war room and a retained forensics firm. The goal is to have answers to three questions before an incident happens rather than during it: