Incidents can be categorized into runbooks where a standardized response process is defined, eliminating inconsistency and ambiguity while increasing operational efficiency. Clearly document use cases that pertain to the incidents commonly faced by your organization.

Customize the malicious email runbook by including the following sections for each single email account multiple email accounts and executive email accounts:

  • Incident summary
  • Escalation process diagram
  • Detailed response procedures
  • Revision history

Align the response procedures with Phase 2 of the blueprint, Develop and Implement a Security Incident Management Program.

Also In

Develop and Implement a Security Incident Management Program

Create a scalable incident response program without breaking the bank.

Related Content


  • Missing comment
    Fadel Ismail Fathimulla | 10-31-2019


    I am trying to modify the hyperlinks in the Malicious Email Runbook, but do not see any option do so in MS Visio.

    Kindly assist.


    • C37c70a10f1741f1652f038d210a8fc3 comment
      Info-Tech Research Group | 11-01-2019

      Hi Fadel - Thanks for reaching out. One of the analysts who designed this tool will be in touch to help you.


Get Access

Get Instant Access
To unlock the full content, please fill out our simple form and receive instant access.
Visit our COVID-19 Resource Center and our Cost Management Center
Over 100 analysts waiting to take your call right now: 1-519-432-3550 x2019