Incident-response playbooks: what each one contains

Each playbook is a one- to two-page checklist written for your company, with names, phone numbers and system locations filled in. These outlines show the structure. Essentials includes the first three; Complete includes all five.

General outlines for planning. In a real incident, follow your finished plan and involve your lawyer, insurer and IT provider.

1. Ransomware E

1. Recognize: ransom note, files renamed or unreadable, mass encryption alerts, unusual logins.
2. Contain immediately: disconnect affected devices from the network (do not power off if your plan says to preserve memory), disable shared drives, isolate backups, reset privileged credentials from a clean device.
3. Declare: notify the incident lead; open the incident log; call your insurer’s hotline if you have a policy.
4. Assess: what is encrypted, whether data was copied out (double extortion), whether backups are intact, which systems are business-critical.
5. Notify: run the breach decision tree; if personal information was accessed or taken and a real risk of significant harm exists, report to the regulator and affected people; give Amazon and key customers notice within contractual limits (Amazon: 24 hours).
6. Eradicate & recover: rebuild from clean images, restore from verified backups, change all credentials, close the entry point, re-scan before reconnecting.
7. Payment decision: a leadership decision made with counsel and the insurer, never by one person under pressure. Law enforcement reporting is part of the checklist.
8. Review: written lessons learned within a set number of days; update the plan and roadmap.

2. Data breach (personal information exposed) E

1. Stop the exposure (misconfigured storage, misdirected email, compromised account, stolen records).
2. Preserve evidence and start the incident log.
3. Identify what data, whose data, how many people, in which provinces, states and countries.
4. Complete the real-risk-of-significant-harm worksheet (sensitivity of the data, probability of misuse).
5. Decide on notifications: OPC (PIPEDA), Alberta OIPC (PIPA), individuals, US state regulators or residents if applicable, customers, Amazon, insurer.
6. Send notices using the templates; record every breach in the breach log (kept 24 months).
7. Offer help to affected people where appropriate (for example, guidance on fraud alerts).
8. Fix the root cause and review the plan.

3. Unauthorized access (account or system compromise) E

1. Disable or reset the affected account; revoke active sessions and tokens; for marketplace or API credentials, revoke and rotate immediately.
2. Check mailbox forwarding rules, new MFA devices, recently created accounts and API keys.
3. Review logs for what the account touched and when.
4. Determine whether personal information was accessed; if yes, switch to the data breach playbook.
5. Notify Amazon at security@amazon.com within 24 hours if Amazon data or credentials may be affected.
6. Remove persistence, patch the cause, enforce MFA, and review access rights.

4. Lost or stolen device C

1. Report to the incident lead immediately (target: within hours).
2. Remote lock or wipe where available; revoke the device’s sessions and tokens; reset passwords it stored.
3. Was the disk encrypted? That fact largely decides whether personal information is considered exposed.
4. List the data on the device and complete the harm assessment.
5. File a police report if theft is suspected; notify insurer if needed.
6. Replace, re-enroll and record the lesson (encryption, MDM, no local copies of customer data).

5. Vendor or supplier breach C

1. Confirm the notice is genuine through a known contact, not a link in the email.
2. Use your inventory to see what data that vendor holds for you and which systems connect to it.
3. Rotate keys, tokens and passwords shared with the vendor; suspend integrations if needed.
4. Ask the vendor for facts: what happened, what data, when, what they have done, and their regulator notices.
5. Decide on your own notification duties (you may still owe notice to people and to Amazon).
6. Review the contract and vendor risk rating; decide to keep, restrict or replace.

Masks.Health - Original Medical Masks Made Before COVID-19 · Calgary, Alberta, Canada. Independent service provider. Related: CyberSecurity by WestNet · WestNet VPN · Amazon Services · Computer Repair · Customer Satisfaction.