Cybersecurity · Advanced level

Advanced level · Module 3: Incident Response and Digital Evidence · Lesson 1 of 4

Incident Response Planning

Prepare roles, contacts and procedures before an incident happens.

In this lesson you will

  • Structure an incident response plan
  • Define roles and communication

Key concepts

NIST SP 800-61 Rev. 3rolescommunication planplaybooks

The lesson

NIST SP 800-61 Rev. 3 (2025) treats incident response as part of cybersecurity risk management under CSF 2.0: preparation and improvement sit in Govern, Identify and Protect, and handling sits in Detect, Respond and Recover.

A plan defines what counts as an incident, severity levels, roles (incident lead, technical lead, communications, management), contact lists and when to involve outside help.

Playbooks give step-by-step actions for common incidents: account compromise, ransomware, lost device, data leak.

Step by step

  1. Define incident and severity levels.
  2. Assign roles.
  3. Build contact lists, including providers and authorities.
  4. Draft two playbooks.

Practice activity

Write the case NGO's incident response plan.

Expected result: A plan with definitions, roles, contacts and two playbooks.

Check your understanding

  1. What framework does SP 800-61 Rev. 3 align incident response with?

    Show answer

    The NIST Cybersecurity Framework 2.0.

  2. What is a playbook?

    Show answer

    Step-by-step actions for a specific type of incident.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.