The next step after understanding and defining an organisation's IR process is to *determine who will be on the organisation's IR team*, who will be in charge of the IR process, and who will lead the IR team. Next, *plans are built*, and then the *plans are tested via exercises*. ### Incident Response Team Building an IR team involves finding the right members for the team. Typical teams often include the following: - A **member of management or organisational leadership**. This individual will be responsible for making decisions for the team and will act as a *primary conduit to senior management* for the organization. Ideally, teams should have a leader with enough seniority to make decisions for the organization in an emergency. - **Information security staff members** are likely to make up the core of the team and will bring the specialised IR and analysis skills needed for the process. Since containment often requires immediate action using security tools like firewalls, intrusion prevention systems, and other security tools, the information security team can also help speed up the IR process. - The team will need **technical experts** such as *systems administrators, developers*, or others from disciplines throughout the organisation. The *composition* of the IR team *may vary depending on the nature of the incident*, and not all technical experts may be pulled in for every incident. Knowing the systems, software, and architecture can make a huge difference in the IR process, and familiarity can also help responders find unexpected artefacts that might be missed by someone who does not work with a specific system every day. - **Communications and public relations** staff are important to help make sure that internal and external communications are handled well. Poor communications—or worse, no communications—can make incidents worse or severely damage an organisation's reputation. - **Legal and human resources** (HR) staff may be involved in some, but not all, incidents. Legal counsel can advise on legal issues, contracts, and similar matters. HR may be needed if staff were involved, particularly if the incident involves an insider or is an HR-related investigation. - **Law enforcement** is sometimes added to a team, but in most cases only when specific issues or attacks require their involvement. ### Exercises There are two major types of exercises that incident response teams use to prepare: - **Tabletop exercises** are used to talk through processes. Team members are given a scenario and are *asked questions about how they would respond*, what issues might arise, and what they would need to do to accomplish the tasks they are assigned in the IR plan. Tabletop exercises can *resemble a brainstorming session* as team members think through a scenario and document improvements in their responses and the overall IR plan. - **Simulations** can include a variety of types of events. Exercises *may simulate individual functions or elements of the plan*, or only target specific parts of an organization. They can also be done at full scale, involving the entire organization in the exercise. It is important to plan and execute simulations in a way that ensures that all participants know that they are engaged in an exercise so that no actions are taken outside of the exercise environment. ### Building Incident Response Plans Incident response plans can include several subplans to handle various stages of the response process. Your organization may choose to combine them all into a single larger document or may break them out to allow the response team to select the components that they need. Individual plans may also be managed or run by different teams. Regardless of the structure of your response plans, they need to be regularly reviewed and tested. A plan that is out of date, or that the team is not familiar with, can be just as much of a problem as not having a plan at all. Several subplans include: - **Communication plans are critical** to incident response processes. A lack of communication, incorrect communication, or just poor communication can cause significant issues for an organization and its ability to conduct business. At the same time, problematic communications can also make incidents worse, as individuals may not know what is going on or may take undesired actions, thinking they are doing the right thing due to a lack of information or with bad or partial information available to them. Because of the importance of getting communication right, communication plans *may also need to list roles*, such as who should *communicate with the press or media*, who will *handle specific stakeholders*, and who makes the *final call on the tone or content* of the communications. - **Stakeholder management plans** are related to communication plans and focus on groups and individuals who have an interest or role in the systems, organisations, or services that are impacted by an incident. Many stakeholder management plans will help with *prioritisation of which stakeholders will receive communications*, *what support they may need*, and how they will be provided with options to offer input or otherwise interact with the IR process, communications and support staff, or others involved in the response process. - [[Business Continuity Plan]] focus on keeping an organization functional when misfortune or incidents occur. In the context of IR processes, BC plans may be used to *ensure that systems or services that are impacted by an incident can continue to function despite any changes* required by the IR process. That might involve ways to restore or offload the services or use of alternate systems. BC plans have a **significant role to play for larger incidents**, whereas smaller incidents may not impact an organisation's ability to conduct business in a significant way. - [[Disaster Recovery Plan]] plans define the processes and procedures that an organization will take when a disaster occurs. Unlike a BC plan, *a DR plan focuses on natural and human-made disasters* that may destroy facilities or infrastructure, or otherwise prevent an organization from functioning normally. A DR plan focuses on restoration or continuation of services despite a disaster.