# Chapter 5: Incident Response

See also:
- [SANS Incident Response Plan](../Standards/SANS/SANS%20Incident%20Response%20Plan.md)
- ISO 27002 5.26


## Pre-incident process
Recognize potential incidents, and initiate the response process. Leverage existing processes (check with support desk). Define what constitutes as an incident.

## Incident processes
- Appoint an Incident Manager
- Define internal communications
	- Open a War Room
	- Have a Conference Bridge to the war room
	- Allocate the task of communicating to internal stakeholders
- Define external communications
- Determine key goals; see Disaster Recovery
- Prepare for longer lasting attacks

## Post-incident process:
- hold a lessons-learned session
- Use this session to update documentation, policies, procedures, and standards

