Skip to main content

Pro audit program · v1.0

Incident Response Plan Quick Check

Is your IR plan more than a PDF? Test for tabletop exercises, RACI, comms templates, escalation paths and lessons-learned.

  • General target area
  • NIST 800-61 framework
  • 7 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Is your IR plan more than a PDF? Test for tabletop exercises, RACI, comms templates, escalation paths and lessons-learned.

Risks addressed

  • Critical Slow, ad-hoc IR extends breach impact
  • High Wrong people contacted (or none) during a real incident
  • High Regulators / customers notified late or inconsistently
  • High Logs purged before forensics can run

Controls (7)

  1. Documented IR plan

    High

    Documented IR plan

    How to test + evidence

    Testing procedure: Confirm an IR plan exists, dated within 12 months, owned + approved.

    Evidence to collect: IR plan PDF.

  2. Roles + RACI defined

    High

    Roles + RACI defined

    How to test + evidence

    Testing procedure: Plan names IR Lead, Comms, Legal, Tech, with contact details.

    Evidence to collect: RACI table in plan.

  3. Tabletop exercise within last 12 months

    High

    Tabletop exercise within last 12 months

    How to test + evidence

    Testing procedure: Last tabletop date + attendees + scenario; lessons-learned actioned.

    Evidence to collect: Tabletop after-action report.

  4. Escalation paths to legal + insurer

    Medium

    Escalation paths to legal + insurer

    How to test + evidence

    Testing procedure: Plan documents when/how to engage legal counsel and cyber insurance.

    Evidence to collect: Plan extract.

  5. Comms templates ready

    Medium

    Comms templates ready

    How to test + evidence

    Testing procedure: Pre-approved templates for staff, customers, regulators, media.

    Evidence to collect: Template library.

  6. Forensic readiness — logs + tools

    High

    Forensic readiness — logs + tools

    How to test + evidence

    Testing procedure: Log sources retained >=90 days; forensic tooling on standby (in-house or retainer).

    Evidence to collect: SIEM retention + retainer contract.

  7. Lessons-learned loop

    Medium

    Lessons-learned loop

    How to test + evidence

    Testing procedure: Closed incidents trigger a post-mortem; actions tracked to completion.

    Evidence to collect: Post-mortem register.