Major outage or denial of service: incident response playbook

First 15 minutes

1. Confirm the scope: which service, which customers, since when.
2. Post an initial status update within 30 minutes.
3. Engage the hosting or network provider.
4. Decide whether to fail over to the recovery site or plan.

Set the severity and download a first-response checklist

What the full playbook covers

• Contain (2 steps)
• Eradicate (1)
• Recover (1)
• Who to notify
• Evidence to keep

The full playbook is in the Incident Response & Business Continuity Kit with 11 more, the IR plan, a BCP/DR plan and 6 tabletop exercises.

Other playbooks

• Phishing and business email compromise
• Ransomware
• Lost or stolen device
• Data sent to the wrong person or exposed
• Compromised account or cloud admin access
• Malware on a device
• Supplier or third-party breach
• Data leaked to an AI tool
• Rogue or misbehaving AI agent
• Prompt injection against an AI assistant or agent
• Deepfake or voice-clone payment fraud