Incident Response Runbook

Incident Response Runbook

Template. The operational play the Incident Response Team runs when a security incident is suspected: the hands-on annex to your Security Incident Response Policy. Replace [bracketed] items and keep the roster current. Satisfies security incident procedures at 45 CFR § 164.308(a)(6).

Incident Response Team (IRT)

Response steps

1. Detect & report: anyone who suspects an incident reports it to [security@org] / the IR Lead immediately; the IR Lead opens an entry in the incident log (time discovered starts the clock).
2. Triage & contain: assess scope and severity; contain (isolate hosts, disable accounts, revoke keys) to stop ongoing harm without destroying evidence.
3. Investigate: determine what happened, what PHI was involved, root cause, and whether it is a breach (run the breach risk assessment with the Privacy Official).
4. Notify: if a breach, follow the Breach Notification process (individuals/HHS/media) or, if you are a Business Associate, the Breach Reporting to Covered Entity process, within the required timeframes.
5. Eradicate & recover: remove the cause, restore from clean backups (see the DR Plan), and confirm safeguards before returning to production.
6. Post-incident review: within [2 weeks], document lessons learned and follow-up actions; update policies, controls, and this runbook.

Record

Log every incident (whether or not a breach) with dates, actions, and outcome; retain for at least [six years]. Reviewed at least annually and after any significant incident. v1.0.