What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A useful incident response plan makes it clear who can declare an incident, who can authorize containment, how responders communicate, how evidence is protected, and who decides when systems are safe to restore. Build those decisions before an attack, then exercise and revise the plan so people can use it under pressure. Preparation can support an effective response, but no universal reduction in response time is established.
Use current guidance without treating every playbook as a universal rule
NIST finalized SP 800-61 Revision 3 in April 2025, superseding Revision 2. The publication frames incident response as part of cybersecurity risk management across the six functions of the NIST Cybersecurity Framework 2.0, rather than as a stand-alone manual for handling an incident after it begins.
As an Amazon Associate I earn from qualifying purchases.
CISA’s federal incident-response playbook offers a more operational workflow: preparation; detection and analysis; containment; eradication and recovery; and post-incident activities. Its defined audience is Federal Civilian Executive Branch agencies dealing with confirmed malicious activity that may have major-incident potential. CISA notes that broader practices can help public- and private-sector organizations, but some procedures are specific to federal agencies. Use the playbook as a reference, not as a blanket rule for every company.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How do you build an incident response plan?
Write the plan around decisions people must make during an incident—not just a list of technical tasks. For each decision, name the accountable role, the information needed, the approval path, and the method for recording what happened.
1. Set authority and name the response team
Identify an incident coordinator and specify who can declare an incident, set its severity, authorize containment, prioritize business services, approve external communications, and decide whether recovery is ready to proceed. Assign a backup for each critical role in case the primary contact is unavailable.
Include the people who can make both technical and business decisions. Depending on the organization, that means security and IT staff, business leadership, legal, communications or public affairs, system and service owners, and relevant outside providers. CISA’s federal checklist calls for a coordination lead and internal notification to leadership, system owners, public affairs, and legal functions; its corporate-leader guidance also emphasizes senior business leadership and board involvement in planning.
2. Define activation, severity, and escalation
Explain how staff report suspected activity, how alerts are triaged, what activates the plan, and how responders distinguish a routine security event from an incident requiring wider coordination. Set escalation thresholds that reflect your systems, likely business impact, and tolerance for disruption. Include an escalation path for uncertainty: responders should know whom to contact when they cannot yet determine the scope.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #2
CISA’s federal playbook uses indicators such as lateral movement, credential access, data exfiltration, intrusion across multiple systems, and compromised administrator accounts as examples of major-incident potential. They can inform an organization’s own thresholds, but they are federal playbook examples—not universal severity rules.
3. Make contacts and communications available during an outage
Maintain current contact details for internal decision-makers and relevant vendors, incident responders, insurers, law enforcement, and government contacts. Record who is responsible for keeping the list current. Store an accessible copy outside systems that could be unavailable or compromised during an attack.
Define alternate communication channels in case ordinary email, collaboration tools, or identity systems cannot be trusted. Assign who communicates with employees, customers, regulators, suppliers, and the public, and who approves each message. CISA recommends a communications plan and prepared holding statements so the organization can acknowledge an incident without making unsupported claims while facts are still developing.
Rank #3
4. Write down the first-response decisions
Give responders a process for establishing what may be affected, what remains uncertain, and which services are most important to keep operating. State who can authorize disruptive containment, how affected service owners are consulted, and how technical actions are coordinated with any retained incident-response provider.
Recommended Free Tools
Containment should reduce harm without causing avoidable operational damage. The plan should tell responders how to weigh the risk of leaving a system connected against the consequences of isolating it, especially when it supports a critical service. Define who makes that trade-off rather than assuming every system can be disconnected safely.
5. Protect evidence and record actions
Designate people authorized to collect evidence and document what was acquired, when, by whom, and how it was protected. Decide how responders will preserve relevant records and securely transfer material to outside investigators when needed. CISA’s checklist describes collecting and preserving data that may support verification, prioritization, mitigation, reporting, attribution, or potential evidence.
Account for evidence that may disappear quickly. CISA’s ransomware guidance calls out system memory and logs with limited retention. Build collection into the response procedure where it is practical and safe; evidence work should be coordinated with containment rather than allowed to delay an urgent action that protects people or essential services.
6. Establish recovery and notification decisions
List recovery priorities and dependencies, identify who can access backups, and name the people authorized to approve restoration. Define what checks must be completed before a system returns to service, such as confirming that the relevant threat has been addressed and that the service owner is ready to resume operations.
Set out how responders will identify whether information was exposed and how that finding is handed to the people responsible for notification decisions. CISA’s ransomware guidance points organizations to applicable breach-notification procedures and recovery planning, including offline backups. Actual deadlines and duties depend on the organization’s jurisdiction, sector, contracts, and circumstances; the plan should route those questions to qualified legal counsel and current regulatory or contractual requirements.
Best Value
7. Exercise the plan, capture gaps, and revise it
Run scenario-based exercises that make participants use the actual authority, contact, and communication paths in the plan. CISA recommends exercising both the response plan and communications plan and identifies cyber exercises as a way to evaluate or develop ransomware response plans.
After an exercise or real incident, record where decisions stalled, which contacts were missing, whether authority was unclear, and which procedures were unusable. Assign an owner and due date to each improvement, update the plan and related materials, and tell affected participants what changed. CISA recommends regular exercises, but the guidance cited here does not prescribe one exercise frequency for every organization.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should a plan include at minimum?
A smaller organization does not need to begin with a complex manual. CISA says a simple emergency plan can be a starting point, including immediate steps such as contacting a service provider, and can be improved over time. At minimum, make sure someone responding can quickly find:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →- Who to contact first and who coordinates the response.
- Who can make urgent business and containment decisions.
- How to protect or isolate affected systems without overlooking operational consequences.
- How the organization will preserve important evidence and keep people informed.
- Who can help if internal staff do not have the necessary response expertise.
For a small team, these responsibilities may be assigned to a few people, but the plan still needs named owners, reachable backups, and an agreed way to make urgent decisions.
What should we do first during a ransomware attack?
Follow the organization’s approved response plan and use this sequence as an operational guide, adapting it to the systems involved and the expertise available.
- Activate the response process. Notify the incident coordinator through a trusted channel and bring in the people authorized to make technical and business decisions.
- Establish likely scope. Identify which systems and services appear affected, what is known about operational impact, and what remains uncertain.
- Contain with the right authority. Isolate affected systems when appropriate; if several systems or subnets are affected, network-level isolation may be needed. Coordinate with service owners before disruptive actions where time and safety permit.
- Preserve relevant evidence. Collect and protect appropriate records, images, memory, logs, malware, or indicators when response conditions allow. Volatile data may be lost if collection is delayed.
- Assess exposure and notification needs. If data exposure is possible, follow the organization’s applicable breach-notification procedures and involve the people responsible for legal and regulatory decisions.
- Prepare recovery. Prioritize critical services, identify usable recovery resources, and consider offline backups as part of the restoration plan. Have the authorized decision-makers approve return to service.
This is not a substitute for the organization’s incident-specific decisions: isolating a system can have serious operational consequences, and the safest action depends on what that system does and what responders know at the time.
Quick Recap
How do NIST and CISA guidance fit together?
| Guidance | Best use | Scope to keep in mind |
|---|---|---|
| NIST SP 800-61 Rev. 3, finalized April 2025 | Integrating incident-response considerations into cybersecurity risk management across CSF 2.0. | It supersedes Rev. 2 and takes a broader risk-management view than a stand-alone incident-handling procedure. |
| CISA federal incident-response playbook | Operational reference for stages from preparation through post-incident activities. | Designed for Federal Civilian Executive Branch agencies and confirmed malicious activity with major-incident potential; some steps are agency-specific. |
| Organization-specific plan | Assigning actual decision authority, service priorities, contacts, procedures, and recovery choices. | Must reflect the organization’s environment and applicable legal, regulatory, insurance, and contractual obligations. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
