Cyber Security Incident Response Planning: Practitioner Guidance

Introduction

Context

Australian organisations are continually targeted by malicious actors, with the Australian Signals Directorate (ASD) assessing that malicious cyber activity against Australia’s national and economic interests is increasing in frequency, scale and sophistication. As malicious actors become more adept, the likelihood and severity of cyber attacks is also increasing due to the interconnectivity and availability of information technology (IT) platforms, devices and systems exposed to the internet.

Managing responses to cyber security incidents is the responsibility of affected organisations. As such, all organisations should have a Cyber Security Incident Response Plan (CSIRP) to ensure an effective response and prompt recovery in the event that system controls do not prevent a cyber security incident from occurring. This plan should be regularly tested and reviewed.

To be effective, a CSIRP should align with organisations’ emergency, crisis and business continuity arrangements, as well as jurisdictional and national cyber and emergency arrangements. It should support personnel to fulfil their roles by outlining their responsibilities and all legal and regulatory obligations.

While organisations are responsible for managing cyber security incidents affecting their business, Australia’s Cyber Incident Management Arrangements outline the inter-jurisdictional coordination arrangements and principles when responding to national cyber security incidents.

Purpose

This guidance (which acts as a CSIRP Template) and the Cyber Security Incident Response Readiness Checklist (Appendix B) are intended to be used as a starting point for organisations to develop their own CSIRP and readiness checklists. Each organisation’s CSIRP and checklist will need to be tailored according to their own unique operating environment, priorities, resources and obligations.

In addition to a CSIRP, organisations can develop more detailed day-to-day processes and procedures to supplement the CSIRP. This could include detailed playbooks to aid in the response to common types of cyber security incidents, such as ransomware or data breaches, and Standard Operating Procedures (SOPs) to respond to cyber security incidents affecting specific assets.

Using this guidance

This guidance is designed to assist organisations in the development of their own CSIRP as part of cyber security incident response planning activities. As part of this guidance, a separate CSIRP Template is available for organisations to fill in with some fields containing example text for demonstrative purposes. Note, the CSIRP Template is not exhaustive. Each organisation’s CSIRP should be tailored according to their own unique operating environment, priorities, resources and obligations.

Acknowledgements

This guidance was created using multiple resources. ASD acknowledges the following resources used in its development:

• ASD Information Security Manual
• Australian Prudential Regulation Authority Prudential Practice Guide CPG 234 Information Security
• CSIRP Template developed by the Australian Energy Sector Readiness and Resilience Working Group in 2019, specifically with support from the Australian Energy Market Operator, Tasmanian Department of State Growth, the Victorian Government Department of Premier and Cabinet and ASD
• Queensland Government Incident Management Guideline
• Victorian Government Cyber Incident Management Plan and Cyber Incident Response Plan Template
• Cybersecurity & Infrastructure Security Agency Federal Government Cybersecurity Incident and Vulnerability Response Playbooks
• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61 Rev. 2, Computer Security Incident Handling Guide
• International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 27035-1:2023, Information technology – Information security incident management – Part 1: Principles and process
• ISO/IEC 27035-2:2023, Information technology – Information security incident management – Part 2: Guidelines to plan and prepare for incident response
• ISO/IEC 27035-3:2020, Information technology – Information security incident management – Part 3: Guidelines for ICT incident response operations.

Contact details

If you have any questions regarding this guidance you can write to us or call us on 1300 CYBER1 (1300 292 371).

Authority and review

Include information about the document owner, document reviewer, approver, version control and date of next review or other thresholds to review the CSIRP. For example, a CSIRP could be reviewed on a time bound basis, such as bi-annually or annually. A CSIRP could also be reviewed when implementing changes following a cyber security incident, a cyber security exercise or organisational shifts. Finally, a CSIRP could be reviewed following changes to relevant policies, plans, legislation, regulation or jurisdictional arrangements.

Document control and review

Version control

Purpose and objectives

Include the purpose and objectives of the CSIRP.

Purpose

To support a swift and effective response to cyber security incidents aligned with the organisation’s security and business objectives.

Objectives

• To provide guidance on the steps required to respond to cyber security incidents.
• To outline the roles, responsibilities, accountabilities and authorities of personnel and teams required to manage responses to cyber security incidents.
• To outline legal and regulatory compliance requirements for cyber security incidents.
• To outline internal and external communication processes when responding to cyber security incidents.
• To provide guidance on post cyber security incident activities to support continuous improvement.

Standards and frameworks

Include the relevant standards and frameworks used to inform the CSIRP.

• National standards and frameworks:
  • Information Security Manual
  • Prudential Practice Guide CPG 234 Information Security
  • Australian Energy Sector Cyber Security Framework
• State/Territory Government standards and frameworks
  • New South Wales Government Cyber Security Incident Emergency Sub Plan
  • Queensland Government Incident Management Guideline
  • South Australian Government Cyber Security Incident Management
  • Tasmanian Government Incident Management Cyber Security Standard
  • Victorian Government Cyber Incident Management Plan
  • Western Australian Government Cyber Security Incident Coordination Framework
• International standards and frameworks:
  • NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide
  • ISO/IEC 27035-1:2023, Information technology – Information security incident management – Part 1: Principles and process
  • ISO/IEC 27035-2:2023, Information technology – Information security incident management – Part 2: Guidelines to plan and prepare for incident response
  • ISO/IEC 27035-3:2020, Information technology – Information security incident management – Part 3: Guidelines for ICT incident response operations.

High level cyber security incident response process

Include a summary of the cyber security incident response process.

Common cyber security incidents and responses

Include commonly used terms and their definitions. A list of commonly used terms and definitions is provided at Appendix A.

Common threat vectors

Include a summary of common threat vectors.

Common cyber security incidents

Include a summary of common cyber security incident types and the initial response activities.

Roles and responsibilities

Include details of the roles and responsibilities of core personnel and teams responsible for cyber security incident response and decision making. At a minimum, include the personnel responsible for receiving the initial notification, the operational level Cyber Security Incident Response Team (CSIRT) and the strategic level Senior Executive Management Team (SEMT).

All personnel listed should be familiar with their responsibilities in the CSIRP and have practise their response.

Points of contact for reporting cyber security incidents

Include details about primary and secondary internal points of contact for personnel or stakeholders to report cyber security incidents to over a 24/7 period.

Cyber Security Incident Response Team

Include details of the CSIRT personnel responsible for managing responses to cyber security incidents. The composition of the CSIRT will vary depending on the size of an organisation and available skills and resources.

Include details of any 3rd party vendors that provide or manage systems, services and/or networks. If applicable, include details of external cyber security incident response providers and the services they provide.

Other CSIRT roles could include system administrators, network engineers, change managers, internal auditors, legal advisors, finance and procurement specialists, and administration and recording keeping personnel.

Surge arrangements

Include process for implementing surge arrangements, the resources involved in those arrangements and thresholds for triggering those surge arrangements. Surge arrangements can include, but are not limited to people, hardware, software and financial resources.

Senior Executive Management Team

Significant cyber security incidents may require the formation of the SEMT to provide strategic oversight, direction and support to the CSIRT, with a focus on:

• strategic issues identification and management
• stakeholder engagement and communications (including Board and ministerial liaison, if applicable)
• resource and capability demand (including urgent logistics or finance requirements, and human resources considerations during response effort).

Include details of the SEMT responsible for managing responses to cyber security incidents. The composition and roles of the SEMT may vary depending on the cyber security incident impact and size and structure of an organisation, as some roles may not be relevant or multiple roles may be held by the same individual.

Roles and responsibilities

Include a diagram picturing the relationship between the key personnel and teams involved in cyber security incident response. For example, the below diagram is taken from the Queensland Government Incident Management Guideline.

Communications

Include the process for managing internal and external communications. Be prepared to:

• support the CSIRT and SEMT communications requirements
• respond to potential increases in internal and external enquiries or complaints about the cyber security incident or the effects, with common questions including:
  • How will the customer helpdesk manage enquiries and be supported?
  • How will the IT helpdesk (or equivalent) manage enquiries and be supported?
  • What communication channels are available to affected customers (e.g. telephone hotline, information on the website or social media)?
• communicate externally about the cyber security incident, including to the public and the media:
  • Who has the primary responsibility for authorising and speaking on behalf of the organisation? How will this person be supported?
  • Who has responsibility for producing and approving information for release to the public and media?
• monitor news media, social media and other forms of media and use it to support communications.

Include details for backup communication channels to communicate with stakeholders and customers.

Internal communications

Include the process and expected timeframes to communicate relevant cyber security incident information to personnel (for example, system users, customer service teams, senior executives and the Board).

In internal messaging, consider how to inform personnel about the cyber security incident and support business continuity. Consider providing:

• a brief summary of the cyber security incident and business impact
• actions currently being undertaken to resolve the cyber security incident
• actions personnel can take to assist
• business continuity options for personnel who are affected by the cyber security incident
• messaging for external stakeholders
• key points of contact for enquiries
• expected timeframes for further updates.

External communications

Include the process and timeframes to communicate relevant cyber security incident information to external stakeholders and customers.

Depending on the impact and severity of the cyber security incident, it may be necessary to communicate with:

• stakeholders required to support with cyber security incident response activities such as government bodies, third party cyber security incident response, law enforcement, insurance providers and/or sector organisations
• the media and customers seeking information about the cyber security incident, such as the general public, government bodies, clients, shareholders, suppliers and/or sector organisations.

In external messaging, consider how to inform external stakeholders and customers about the cyber security incident based upon their role or interest. Consider:

• information they need to know:
  • systems, services or networks affected
  • steps being taken to resolve the cyber security incident
  • who is supporting cyber security incident remediation activities
• any options or actions for stakeholders affected by the cyber security incident to take
• key points of contact for enquiries
• expected timeframes for further updates.

Consider supporting requests for information from interested sector and government bodies following the cyber security incident for the purpose of information sharing and learning from the experience.

Supporting procedures and playbooks

Supporting procedures

Include a list of SOPs developed to support cyber security incident response, and their physical and electronic locations. Examples of SOPs are:

• event detection, triage and analysis
• post cyber security event/incident detection or notification
• cyber security incident detection, investigation and analysis
• cyber security incident containment, remediation and recovery
• Communications Plan (internal and external)
• Emergency Management Plan
• Crisis Management Plan
• Business Continuity Plan
• Disaster Recovery Plan.

Supporting playbooks

Playbooks are documents that are intended to contain easy to follow instructions to assist in ensuring all appropriate steps are taken when responding to specific types of cyber security incidents. Include a list of playbooks and their physical and electronic locations. Example cyber security incidents that may have a playbook are:

• Cyber Security Incident Response Playbook – Phishing
• Cyber Security Incident Response Playbook – Data Breach/Theft
• Cyber Security Incident Response Playbook – Malware
• Cyber Security Incident Response Playbook – Ransomware
• Cyber Security Incident Response Playbook – Denial of Service.

Sector, jurisdictional and national cyber security incident response arrangements

Include information about the relevant sector, state and/or territory and national arrangements for cyber security incident related activities, including, but not limited to, notification, reporting and/or seeking additional support.

The CSIRP could include a process chart of when to report cyber security incidents to relevant government bodies and/or seek assistance.

Sector arrangements

Include information about the relevant sector arrangements and the process for implementing these arrangements.

Jurisdictional arrangements

Each state/territory jurisdiction has its own cyber security incident response arrangements. Organisations should contact the relevant government body in their jurisdiction to understand the arrangements that apply.

Include information about the process for reporting to and/or seeking assistance from state/territory law enforcement.

National arrangements

Include information about the process for reporting to and/or seeking assistance from Federal Government bodies. For example, Australia’s Cyber Incident Management Arrangements outline the inter-jurisdictional coordination arrangements and principles when responding to national cyber security incidents.

Examples of potential national cyber security incidents include:

• an organisation with links across multiple jurisdictions being compromised through a cyber security incident
• malicious cyber activity affecting critical national infrastructure where the consequences have the potential to cause sustained disruption of essential services or threaten national security
• malicious cyber activity where the cause and potential extent of its geographic impact is uncertain
• a large-scale breach of sensitive data affecting persons or organisations in multiple jurisdictions.

ASD leads the Australian Government’s response to cyber security incidents. For information on how to report cyber security incidents to ASD, and to seek advice and assistance, visit ASD’s reporting website. Note, cyber security incidents reported to ASD by organisations may be protected under the limited use obligation. Under the limited use obligation, any information voluntarily provided to ASD about cyber security incidents or vulnerabilities cannot be used for regulatory purposes.

Appendix C lists some of the common triage questions ASD will use to assess the severity of a reported cyber security incident.

Cyber security incident notification and reporting

Include internal and external processes for cyber security incident notification and reporting. Consider sector, state/territory and national cyber security incident notification and reporting obligations.

Include details about who is responsible for cyber security incident notification and reporting to external entities.

Legal and regulatory requirements

Include details about any legal and regulatory obligations, such as contractual and legislative reporting requirements. Work with any compliance and legal personnel to ensure the CSIRP covers all relevant requirements, noting that different cyber security incidents may require different or multiple legal and regulatory responses.

The CSIRP could include a process chart of when to report cyber security incidents to relevant government bodies, regulators and other external parties.

Insurance

Include relevant details about any insurance policies for cyber security incidents.

Detection, investigation, analysis and activation

Include the decision making framework for activating the CSIRP.

Detecting cyber security incidents

Cyber security incidents could be detected in several ways, including, but not limited to:

• self-detected (e.g. via Intrusion Detection and Prevention Systems)
• notifications received from service providers or vendors
• notifications received from trusted third parties, such as ASD.

Cyber security incident classification

Include the framework and decision making process for classifying a cyber security incident. This can assist with prioritising resources. Classification factors could include:

• effects of the cyber security incident (confidentiality, integrity and availability of systems and their resources)
• stakeholders affected (internal and external)
• cyber security incident type
• impact on the business and community.

For information about the ASD Cyber Security Incident Categorisation Matrix see Appendix K.

Cyber Security Incident Response Team activation

Include the decision making framework for activating the CSIRT. This could align with the cyber security incident classification framework. Note, some smaller cyber security incidents may be manageable without activation of the CSIRT.

Logistics and communications

Include core logistical and communications protocols and mechanisms used to support cyber security incident response. For example:

• operations room/security operations centre (SOC) location and setup
• equipment required for offsite cyber security incident response
• communications technologies such as phone/teleconference/online dial-in details and out-of-band communications (e.g. Slack or other similar applications).

Investigation questions

To guide cyber security incident response efforts, and understanding of the scope and impact of the cyber security incident, develop a list of investigation questions. Note, not all questions may be answerable with the data available and questions may change as investigations progress.

Possible investigation questions include:

• What was the initial intrusion vector?
• What post-exploitation activity occurred? Have accounts been compromised? What level of privilege was involved?
• Does the malicious actor have persistence on systems, services or networks?
• Is lateral movement suspected or known? Where has the malicious actor laterally moved to and how?
• How is the malicious actor maintaining command and control?
• Has data been accessed or exfiltrated and, if so, what kind of data?

Escalation and de-escalation

Include the escalation and de-escalation triggers and/or thresholds and decision making authorities.

Containment, evidence collection and remediation

Containment

Containment actions are implemented in order to minimise damage, prevent the cyber security incident from spreading or escalating, and prevent malicious actors from destroying evidence.

When planning containment actions, consider:

• any additional impacts there could be to systems, services or networks
• time and resources required to contain the cyber security incident
• effectiveness of the containment solution (e.g. partial vs full containment)
• duration that the containment solution will remain in place (e.g. temporary vs permanent solution).

Documentation

Include processes and procedures for documenting the cyber security incident, including responsible personnel and timeframes. Refer to Appendix D for a Situation Report Template and Appendix E for a Cyber Security Incident Log Template.

Situation Reports may contain the following information:

• cyber security incident date and time
• status of the cyber security incident
• cyber security incident type and classification
• cyber security incident scope and impact
• cyber security incident severity
• external assistance required
• actions taken to resolve the cyber security incident
• contact details for key CSIRT personnel
• date and time of the next update.

Evidence collection and preservation

Include processes and procedures for collecting, preserving, handling and storing evidence, including responsible personnel and timeframes. As this can be complex, if necessary, seek advice from digital forensic professionals, legal advisors or law enforcement.

When gathering evidence, maintain a detailed log that clearly documents how all evidence has been collected. This should include who collected or handled the evidence, the time and date (including time zone) evidence was collected and handled, and the details of each item collected (including the physical location, serial number, model number, hostname, media access control [MAC] address, Internet Protocol [IP] address and hash values). See Appendix F for a template.

Examples of commonly collected evidence include:

• hard drive/host images
• network packet captures and flows
• IP addresses
• log files
• network diagrams
• configuration files
• databases
• investigation notes
• screenshots
• social media posts
• close-circuit television, video and audio recordings.

Remediation Action Plan

Include processes and procedures for developing and implementing a Remediation Action Plan to resolve the cyber security incident following successful containment and evidence collection. See Appendix G for a template.

When developing the Remediation Action Plan, consider:

• What actions are required to resolve the cyber security incident?
• What resources are required to resolve the cyber security incident (if not already included in the CSIRT)?
  • Are there additional external resources required?
• Who is responsible for remediation actions?
• What systems, services or networks should be prioritised?
• What systems, services or networks will be affected during the remediation process?
  • How will these systems, services or networks be affected?
• What is the expected resolution time?

Recovery

Include processes and procedures for developing, authorising and executing an agreed Recovery Plan.

The Recovery Plan should detail the approach to recovering IT and/or operational technology (OT) systems, services and networks once containment and remediation is complete.

When developing the Recovery Plan, consider:

• How will systems, services and networks be restored to normal operation and in what timeframe?
• How will systems, services and networks be monitored to ensure they are no longer compromised and are functioning as expected?
• How will identified vulnerabilities be managed to prevent similar cyber security incidents from occurring in the future?

Stand down

Include decision making processes and procedures for standing down the CSIRT and SEMT.

Include the processes and procedures for completing a Cyber Security Incident Report, including responsible personnel and timeframes. Consider creating a Cyber Security Incident Report Template as an appendix to the CSIRP.

Learn and improve

Include an approach to capture lessons learn from the cyber security incident.

Post cyber security incident review

A post cyber security incident review is a detailed review conducted after an organisation has experienced a cyber security incident. It can include a hot debrief which is held immediately after an organisation has recovered its systems, services or networks from a cyber security incident and/or a formal debrief held after the Cyber Security Incident Report has been completed, such as within two weeks.

Key questions to consider during a post cyber security incident review include:

• What were the root causes of the cyber security incident?
• Could the cyber security incident have been prevented? How?
• What worked well in the response to the cyber security incident?
• How could our response be improved for future cyber security incidents?

Refer to Appendix H for more detailed questions to consider in post cyber security incident reviews.

Recommendations that arise from the review can be documented in a corresponding Action Register. Refer to Appendix I for an Action Register Template.

PPOSTTE model

The PPOSTTE model can assist in reflecting on key elements of the cyber security incident response:

• People: Roles, responsibilities, accountabilities, skills.
• Process: Plans, policies, procedures, protocols, processes, templates, arrangements.
• Organisation: Structures, culture, jurisdictional arrangements.
• Support: Infrastructure, facilities, maintenance.
• Technology: Equipment, systems, standards, security, inter-operability.
• Training: Qualifications/skill levels, identification of required courses.
• Exercise management: Exercise development, structure, management, conduct.

Update and test Cyber Security Incident Response Plan

The post cyber security incident review may result in changes to the CSIRP, playbooks and templates. Changes should be communicated to the relevant personnel.

Significant changes may require the CSIRP, playbooks and templates to be tested. Regular testing is important to ensure these documents remain current and are familiar to relevant personnel. Testing methods could include tabletop exercises or functional exercises.

Training

Include training activities, and associated support, required for personnel to effectively undertake their roles when responding to a cyber security incident.

The post cyber security incident review may identify additional specialised training for personnel involved in cyber security incident response or general cyber security awareness training for all personnel.

Appendix A – Terminology and definitions

Use of consistent and pre-defined terminology to describe cyber security incidents and their effects can be helpful as part of cyber security incident response planning.

Cyber threat

A cyber threat is any circumstance or event with the potential to harm systems or data.

Examples of cyber threats include (but are not limited to):

• business email compromise
• cybercrime
• cyber supply chain compromise
• exploitation of vulnerabilities
• phishing emails and scams
• ransomware.

Cyber security alert

A cyber security alert is a notification generated in response to a deviation from normal behaviour. Cyber security alerts are used to highlight cyber security events.

Cyber security event

A cyber security event is an occurrence of a system, service or network state indicating a possible breach of security policy, failure of safeguards or a previously unknown situation that may be relevant to security.

Examples of cyber security events include (but are not limited to):

• a user has disabled the antivirus on their computer
• a user has deleted or modified system files
• a user restarted a server
• unauthorised access to a server or computer.

Cyber security incident

An unwanted or unexpected cyber security event, or a series of such events, that either has compromised business operations or has a significant probability of compromising business operations.

Examples of cyber security incidents include (but are not limited to):

• denial-of-service attacks
• unauthorised access or attempts to access a system
• compromise of sensitive data
• virus or malware outbreak (including ransomware).

Appendix B – Cyber Security Incident Response Readiness Checklist

This checklist is provided to aid the initial assessment of an organisation’s readiness to respond to a cyber security incident. This checklist is not an exhaustive list of all readiness activities.

Appendix C – ASD cyber security incident triage questions

Where applicable, personnel reporting cyber security incidents to ASD on behalf of their organisation should try to have information available to answer the following questions:

• Who is reporting the cyber security incident? (e.g. CISO, SOC Manager)
• Who/what is the affected organisation/entity?
• What type of cyber security incident is being reported? (e.g. ransomware, denial of service, data breach, malware)
• Is the cyber security incident still active?
• When was the cyber security incident first identified?
• Is reporting for ASD awareness or is ASD assistance required?
  • If ASD assistance is required, what assistance is required?
• What type of system, service or network has been affected?
• What was observed (e.g. the sequence of events)?
  • date/time
  • effect/event
• Who or what identified the problem?
• Has a data breach occurred?
  • What type of data was exposed?
  • What volume of data was exposed?
  • What impact will this have on your organisation?
  • What impact (if any) will the data breach have on public safety or services?
  • Was it a misconfiguration/error, or was a malicious exfiltration or theft of data identified?
  • If applicable under the Notifiable Data Breaches scheme, has it been reported to the OAIC?
• What actions have been taken to rectify the issue?
  • Are internal or external cyber security incident response providers involved?
  • Are business as usual operations interrupted? If so, how long before operations will be back to normal?
• Will information about the cyber security incident be communicating publicly (e.g. with customers and/or the media)?
  • If so, please notify ASD beforehand if you will be referencing ASD.

Appendix D – Situation Report Template

Appendix E – Cyber Security Incident Log Template

Appendix F – Evidence Register Template

Appendix G – Remediation Action Plan Template

Appendix H – Post cyber security incident reviews

A post cyber security incident review is a detailed review conducted after an organisation has experienced a cyber security incident. The content of the review will vary for each organisation, but primarily focuses on establishing learnings and providing recommended actions to mitigate future cyber security incidents. The purpose of this guide is to provide organisations that have experienced a cyber security incident with tools and techniques to conduct a post cyber security incident review.

How to use this guide

This guide contains high level steps recommended for organisations to follow after experiencing a cyber security incident. The guide should be used as a resource, and will need to be further tailored by organisations to suit their individual requirements. The templates provided are generic and will need to be tailored to suit specific organisational requirements.

Post cyber security incident review steps

Step 1 – Hold cyber security incident debriefs

Post cyber security incident debriefs are useful for capturing observations from personnel directly involved in managing a cyber security incident and identifying actions to improve how their organisation managed its response, as well as how the cyber security incident could have been prevented. There are two types of debriefs organisations may hold after experiencing a cyber security incident: a hot debrief and a formal debrief (also known as a cold debrief).

A hot debrief is held immediately after an organisation has recovered its systems, services or networks from a cyber security incident. The benefits of holding a hot debrief include:

• the team involved in responding to the cyber security incident can provide instant feedback and lessons learned
• any urgent issues identified during the cyber security incident can be addressed immediately
• personnel involved in the cyber security incident are more likely to recall information and detail as it is still fresh in their minds.

A formal debrief is held days to weeks after an organisation has recovered its systems, services or networks from a cyber security incident. The benefits of holding a formal debrief include:

• it provides an opportunity to discuss the cyber security incident in detail after it is resolved to gather key insights, learnings and opportunities for improvement
• it provides time between the cyber security incident and debrief allowing emotions to settle, particularly for stressful cyber security incidents
• it ensures all key personnel required for discussions are present, especially senior management who will need to drive the implementation of actions.

Hot debrief guidance

Time

30 minutes – 1 hour.

Aim

The aim of the hot debrief is to review the cyber security incident, receive feedback on personnel observations and insights, and identify any urgent issues requiring immediate action.

Participants

The hot debrief should be led by a facilitator (such as a manager who was involved during the cyber security incident) and supported by a scribe whose role is to document attendance, key insights and immediate actions. It is recommended that hot debrief participants include all personnel involved during the detection, response and recovery phases of the cyber security incident, with upper management excluded (e.g. Chief Executive Officers and General Managers). This will ensure personnel involved in the cyber security incident can speak openly without fear of repercussion.

Content

The facilitator could guide discussion using the following questions:

• What went well?
• What could we do differently next time to improve?
• What action has been taken to remediate immediate risk?
• Are there any further issues that require immediate resolution?

Note, it is essential for the facilitator to remain objective during the discussion, and treat the cyber security incident as a learning point for all involved, without attributing blame to an individual or team.

Conclusion

At the end of the hot debrief, the facilitator should provide a summary of the discussions to participants who can confirm whether the key issues and actions were captured. The facilitator should explain the next steps and the expected timeframes for these.

Formal debrief guidance

Time

1–2 hours.

Aim

The aim of the formal debrief is to review the cyber security incident, validate what worked, and produce actions and assigned responsibilities to improve current arrangements.

Participants

The formal debrief should be led by a facilitator who asks key questions, supported by a scribe to document attendance, key insights and actions.

It is recommended that formal debrief participants include:

• technical personnel who were involved in detecting, responding to and resolving the cyber security incident
• non-technical personnel who were involved during the cyber security incident
• communications/media personnel involved in the cyber security incident.

Content

Questions to consider in the formal debrief can be found in the Post Cyber Security Incident Review Analysis Template. The facilitator can use this guidance to lead the conversation with the participants while the scribe documents the discussion directly into the template. The scribe can also use the Action Register Template to document any actions resulting from the discussion.

Conclusion

At the end of the debrief, a decision should be made about whether additional discussions are required, or if finalisation of the cyber security incident documentation can be completed. If email correspondence is selected to disseminate the documentation, an action officer will need to be identified for completing them and circulating them to staff for endorsement.

Step 2 – Complete cyber security incident documentation

Based on the findings of the debriefs, the action officer should complete a draft of the Post Cyber Security Incident Review Analysis and the Action Register and circulate them to the personnel involved in the debrief for their feedback and endorsement. Note, it is important that the Action Register details an assigned lead (action officer) for closing out each action.

Once feedback is received and incorporated, documentation should be sent to an executive staff member (e.g. a Chief Executive Officer or General Manager) for endorsement. The executive staff member may advise their expectations on the frequency of progress reporting of agreed actions and nominate a person to lead tracking and reporting.

Step 3 – Cyber security incident tracking and reporting

The identified actions should be tracked and reported at agreed frequencies.

Post Cyber Security Incident Review Analysis Template

Cyber security incident analysis

Cyber security incident analysis is broken into the following categories:

• Timeline: Summary of what happened and when. Provides high level areas for improvement.
• Protection: Identifies the control mechanisms that were in place at the time of the cyber security incident and their effectiveness. Establishes how to improve the protection of systems, services and networks.
• Detection: Establishes how to reduce the time to identify a cyber security incident. Addresses what detection mechanisms were in place and how those mechanisms could be improved.
• Response: Identifies improvements for the cyber security incident response.
• Recovery: Addresses improvements for cyber security incident recovery.

Appendix I – Action Register Template

Appendix J – Role cards

Example of a role card:

Appendix K – ASD Cyber Security Incident Categorisation Matrix

ASD categorises cyber security incidents by severity using a matrix that considers the:

• cyber effect (i.e. the impact, success, sustained and/or intent)
• significance (i.e. sensitivity of the organisation).

The severity of the cyber security incident informs the type and nature of cyber security incident response and crisis management arrangements that are activated. Depending on the severity of the cyber security incident, ASD has a suite of capabilities that it may deploy to support the affected parties. However, ASD determines which capabilities are appropriate and available given competing priorities. Organisations must not rely on ASD for their ability to respond to cyber security incidents in an appropriate and timely manner.