AO coverage. Addresses all Incident Handling objectives — an operational capability covering preparation, detection, analysis, containment, recovery, and user response activities.

Preparation. A named incident commander and two backups, an on-call rotation with a paging tool, a severity ladder pinned to the first page of the runbook, pre-authorized containment actions (isolate an endpoint, disable an account, block a sender) that on-call may take without waking an executive, an out-of-band communication channel that does not depend on the identity provider we might be evicting an attacker from, and printed contact cards for legal, the customer, and the provider. Preparation also includes the boring part: the asset inventory and network diagram the responder will need at 2 a.m.

Detection. Endpoint detections, identity risk events, and log-source alerts route to the paging tool with severity attached; the provider triages overnight and pages only on qualifying alerts. User reports arrive through a report-phish button and the help desk, and are treated as a detection source with the same intake path — several of our real incidents started there.

Analysis. Every page opens a case record. The responder establishes scope (which identities, which hosts, what data), determines whether CUI is implicated — a question asked explicitly on every case because it drives external reporting — and records a timeline as they go rather than reconstructing it afterward. The severity ladder is re-evaluated after initial analysis; downgrades are as normal as upgrades.

Containment. Pre-authorized actions first, then a containment decision by the incident commander weighing evidence preservation against spread. For identity compromise the standard play is revoke sessions, reset credentials, re-register authentication methods, and review what the account touched. Forensic images are taken before rebuild on any case where CUI exposure is plausible.

Recovery. Restore from known-good, validate the entry vector is closed before returning to service, and monitor the affected scope at elevated sensitivity for a defined watch period. Recovery is declared by the incident commander, not by whoever finished their task first.

User response activities. Users are told what to do (report, do not delete, do not investigate on your own), what will be asked of them, and what happens to their device. Affected users receive direct instructions during the incident; the workforce receives a short awareness note afterward when the lesson generalizes.

Maintenance. After-action review within ten business days on every qualifying incident, with action items tracked in the plan of action. Runbook revised whenever an after-action finds it wrong.

Accepted gap. We have no in-house forensic capability beyond memory and disk capture. Deep analysis is contracted to an incident response firm on retainer; the retainer, the engagement trigger, and the data-handling terms are documented so nobody negotiates a contract during an incident.

• Incident response plan with the phase runbooks and the severity ladder
• On-call rotation export and a sample page-to-acknowledgment timeline
• Redacted case record showing scope, CUI determination, timeline, and containment decision
• Pre-authorized containment action list approved by management
• After-action report with tracked action items, and the response firm retainer