Develop and Implement a Security Incident Management Program
Create a scalable incident response program without breaking the bank.
Security incidents are inevitable, but how they’re dealt with can make or break an organization. Poor incident response negatively affects business practices, including workflow, revenue generation, and public image.
The incident response of most organizations is ad hoc at best. A formal management plan is rarely developed or adhered to, resulting in ineffective firefighting responses and inefficient allocation of resources.
Our Advice
Critical Insight
- Embrace the use of ready-made responses when handling incidents. These pre-established response plans can save valuable time and effort during a crisis. By relying on proven and tested procedures, your team can respond swiftly and efficiently, minimizing the impact of incidents and ensuring a consistent approach to resolving security breaches.
- Analyze, track, and review results of incident response regularly. Without a comprehensive understanding of incident trends and patterns, you can be revictimized by the same attack vector.
- Establish communication processes and channels well in advance of a crisis. Don’t wait until a state of panic. Collaborate and exchange information with other organizations to stay ahead of incoming threats.
Impact and Result
- Effective and efficient management of incidents involves a formal process of preparation, detection, analysis, containment, eradication, recovery, and post-incident activities.
- This blueprint will walk through the steps of developing a scalable and systematic incident response program relevant to your organization.
Member Testimonials
After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve. See our top member experiences for this blueprint and what our clients have to say.
9.5/10
Overall Impact
$31,984
Average $ Saved
18
Average Days Saved
Client
Experience
Impact
$ Saved
Days Saved
Northland Power Inc
Guided Implementation
10/10
$3,000
5
very helpful advice on revising/updating our cyber security incident response plan.
IAMGOLD Corporation
Guided Implementation
9/10
N/A
2
InfoTech provided a wide range of practical documentation, templates, and diagrams, complemented by valuable, actionable advice from the consultant... Read More
Member Organization
Guided Implementation
10/10
$68,999
20
My experience has been great so far!!
Member Organization
Workshop
10/10
$34,499
20
I now have clarity on who needs to make decisions between IT leadership and organizational leadership. My staff now have a detailed workflow to wor... Read More
Member Organization
Guided Implementation
9/10
$6,899
10
Member Organization
Guided Implementation
10/10
$50,000
50
Info-Tech played a key role in shaping our incident response plans by providing valuable feedback and expert guidance throughout the process. Lever... Read More
Member Organization
Guided Implementation
10/10
$54,400
10
Interaction with a knowledgeable resource to help guide and develop solution for our organization.
Member Organization
Guided Implementation
9/10
$27,500
10
The best part is that all runbooks are ready to be used, and the advisor is knowledgeable. The downside is that some tools contain grammatical err... Read More
Member Organization
Guided Implementation
10/10
$37,500
16
Member Organization
Workshop
6/10
$13,600
10
Emphasis was placed on hitting time slots for each day's completion rather than on the accuracy and relevance of the information. This despite ulti... Read More
Member Organization
Workshop
9/10
$136K
32
Best -Team collaboration Worst - Rabbit hole
Member Organization
Workshop
10/10
$34,000
26
Best part is having the whole suite of incident management references with 2 TTX's accomplished by end of workshop. Worst part is the minimal st... Read More
Member Organization
Workshop
10/10
$34,000
20
Horia was great to work with on this project.
Member Organization
Guided Implementation
10/10
$2,584
10
I really enjoyed the interactive nature of the assistance through the case.
Member Organization
Guided Implementation
10/10
N/A
20
Mike was awesome. He was able to help us think through how we could apply your blueprints to existing process, and was also a great sounding board... Read More
Member Organization
Guided Implementation
9/10
$10,000
10
Member Organization
Guided Implementation
10/10
$13,600
10
Member Organization
Guided Implementation
9/10
$21,760
14
Mike was able to immediately address our needs by providing straight to the point assistance. I would be happy to get help again in the future.
Member Organization
Workshop
10/10
$34,000
10
A big thank you to Horia for the outstanding job facilitating the security incident workshop and tabletop exercise. Your expertise and guidance mad... Read More
Member Organization
Guided Implementation
10/10
$68,000
23
Petars insight into security and governance has really made a difference in our posture and preparedness. We can purchase solutions all day but not... Read More
Member Organization
Guided Implementation
10/10
$34,000
10
Petar Hristov did a phenomenal job of walking us through the Develop and Implement a Security Incident Management Program. His advice was extremely... Read More
Member Organization
Guided Implementation
10/10
$3,179
5
It was easy to engage with InfoTech. Also the security management blueprint from InfoTech was the closest to my requirements.
Member Organization
Guided Implementation
9/10
$12,240
14
It's all laid out for you and ready to modify as needed. Our SME was very knowledgeable and patient with our team.
Member Organization
Workshop
9/10
N/A
35
The best parts of the experience was the customization of the workshop to meet our needs. This was accomplished through preparatory calls as well ... Read More
Member Organization
Guided Implementation
8/10
$1,700
2
Member Organization
Guided Implementation
10/10
$34,250
10
The personal connection with an analyst.
Member Organization
Workshop
9/10
$50,000
14
The best part was coming together as a consortium and forcing ourselves, with Horia's assistance to dedicate the time to complete this incredibly i... Read More
Member Organization
Guided Implementation
10/10
$32,195
10
Member Organization
Guided Implementation
10/10
$13,700
105
Willingness to provide guidance and followup
Member Organization
Guided Implementation
10/10
N/A
20
Robert is very knowledgeable providing practical advice and guidance. The facilitation of the tabletop exercise was a beneficial exercise to comple... Read More
Workshop: Develop and Implement a Security Incident Management Program
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Module 1: Prepare Your Incident Response Program
The Purpose
- Understand the purpose of incident response.
- Formalize the program.
- Identify key players and escalation points.
Key Benefits Achieved
- Common understanding of the importance of incident response.
- Various business units becoming aware of their roles in the incident management program.
- Formalized documentation.
Activities
Outputs
Assess the current process, obligations, scope, and boundaries of the incident management program.
- Understanding of the incident landscape
Identify key players for the response team and for escalation points.
- An identified incident response team
Formalize documentation.
- A security incident management charter
- A security incident management policy
Prioritize incidents requiring preparation.
- A list of top-priority incidents
- A general security incident management plan
- A security incident response RACI chart
Module 2: Develop Incident-Specific Runbooks
The Purpose
- Document the clear response procedures for top-priority incidents.
Key Benefits Achieved
- As incidents occur, clear response procedures are documented for efficient and effective recovery.
Activities
Outputs
For each top-priority incident, document the workflow from detection through analysis, containment, eradication, recovery, and post-incident analysis.
- Up to five incident-specific runbooks
Module 3: Maintain and Optimize the Program
The Purpose
- Ensure the response procedures are realistic and effective.
- Identify key metrics to measure the success of the program.
Key Benefits Achieved
- Real-time run-through of security incidents to ensure roles and responsibilities are known.
- Understanding of how to measure the success of the program.
Activities
Outputs
Limited scope tabletop exercise.
- Completed tabletop exercise
Discuss key metrics.
- Key success metrics identified
About Info-Tech
Info-Tech Research Group is the world’s fastest-growing information technology research and advisory company, proudly serving over 30,000 IT professionals.
We produce unbiased and highly relevant research to help CIOs and IT leaders make strategic, timely, and well-informed decisions. We partner closely with IT teams to provide everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for their organizations.
What Is a Blueprint?
A blueprint is designed to be a roadmap, containing a methodology and the tools and templates you need to solve your IT problems.
Each blueprint can be accompanied by a Guided Implementation that provides you access to our world-class analysts to help you get through the project.
Need Extra Help?
Speak With An Analyst
Get the help you need in this 3-phase advisory process. You'll receive multiple touchpoints with our researchers, all included in your membership.
Guided Implementation 1: Prepare
- Call 1: Understand the incident response process, and define your security obligations, scope, and boundaries.
- Call 2: Formalize the incident management charter, RACI, and incident management policy.
Guided Implementation 2: Operate
- Call 1: Prioritize and develop top-priority runbooks.
- Call 2: Develop templates to analyze root cause and report security incidents.
Guided Implementation 3: Maintain and optimize
- Call 1: Develop and facilitate tabletop exercises.
- Call 2: Create an incident management metrics program and assess the success of the incident management program.
Contributors
- Dave Millier, CEO, Uzado Inc.
- Mahmood Sher-Jan, EVP & General Manager, RADAR Product Unit
- Matt Anthony, VP, Security Remediation Services, The Herjavec Group
- Jason Bareiszis, CSIRT Manager & Principal Security Architect, Tetra Tech
- Malcolm Brown, Industry Analyst Relations, Trend Micro
- Mark Bernard, CISO, Government, Financial Services, Manufacturing, Pharma, Legal
- Wayne Chung, Senior Consultant, Information Assurance, Eosensa
- Ali Shahidi, Chief Cyber Security & Computer Forensics, InfoTransec Inc.
- Ian Parker, Head of Corporate System Information Security, Risk, and Compliance, Fujitsu Services
- Joey LaCour, CISO, Colonial Savings, F.A.
- Ron Kirkland, Manager ICT Security, Crawford and Company
- Vincent di Giambattista, Director IT Security and Compliance, Alliance Healthcare Ltd.
- Five anonymous contributors
Develop and Implement a Security Incident Management Program
Build Resilience Against Ransomware Attacks
Build a Vendor Security Assessment Service
Implement Risk-Based Vulnerability Management
Improve Organizational Resilience With a Tabletop Program
Master Your Security Incident Response Communications Program
Design a Coordinated Vulnerability Disclosure Program
