← Toolkit
TPL-110PlanCyber resilienceCrisis management
Cyber incident response plan
The five decisions prepared in advance, and the single escalation chain.
The plan connects CSIRT, crisis team and continuity around a single alert chain, and settles in advance the five decisions impossible to take under pressure: mass disconnection, service shutdown, ransom position, communication, restoration point.
How to use it
- Settle the ransom position at board level, not overnight
- Provide an isolation procedure executable without the directory
- Retain logs for six to twelve months to date the compromise
Courses that use it
Related templates
TPL-031
Role-based action cards
Double-sided A5: ten actions, three prohibitions, no cross-references.
TPL-032
Crisis directory
A single source, two deputies per role, tested twice a year.
TPL-060
Severe scenario library
Twenty ready-to-run scenarios covering the six disruption families.
TPL-081
Backup and restoration policy
3-2-1-1-0 rule, administration domain isolation, test plan.