Playbooks
Phishing
Last Updated: September 20, 20261. Preparation Objective: Reduce what a successful message can achieve, and make reporting one fast, rather than trying to stop every message arriving.
Ransomware
Last Updated: September 20, 20261. Preparation Objective: Be able to survive encryption without paying, which is a backup and identity problem long before it is a malware problem.
Unix / Linux Intrusion Detection
Last Updated: September 20, 2026This playbook covers investigating a Unix or Linux host suspected of compromise, following the standard six-phase incident response model: preparation, identification…
Windows Intrusion
Last Updated: September 20, 2026This playbook covers investigating a Windows host suspected of compromise.
Worm Infection
Last Updated: September 20, 2026A worm is malware that propagates without user action, exploiting a network-reachable weakness to move from host to host.
Vulnerability Scanning
Last Updated: September 20, 2026This document describes a recurring operational process rather than a response to a single incident.
Unauthorised Use
Last Updated: September 20, 20261. Preparation Objective: Handle misuse of the organisation's systems by people who are entitled to be there, fairly and consistently, without turning every policy…
Website Compromise
Last Updated: September 20, 20261. Preparation Objective: Be able to restore a trustworthy public-facing site quickly, and to know what the attacker did to visitors as well as to the server.
Data Breach
Last Updated: September 20, 20261. Preparation Objective: Be ready to establish, within a very short and legally fixed window, whether personal or regulated data was accessed by someone with no right…
Data Loss
Last Updated: September 20, 20261. Preparation Objective: Be able to tell, quickly and defensibly, what data left the organisation, who moved it, and whether it mattered.
Malware
Last Updated: September 20, 20261. Preparation Objective: Ensure the estate is instrumented well enough to answer the only question that matters during a malware incident, which is not what the…
Physical Security Compromise
Last Updated: September 20, 20261. Preparation Objective: Respond to a breach of physical security as an information security incident, because physical access defeats most logical controls.