Stage 4: Specify how an incident will be handled

Planning allowance: 1 week; 8–16 hours. Design the operating process before selecting the logo. NIST's 2025 incident-response guidance treats response as part of continuing risk management; the following execution worksheet is an original buyer tool.

Describe two realistic scenarios and walk through them with IT, the provider, the business owner and counsel. Record who receives the first alert, investigates the account or device, authorizes interruption, communicates internally, preserves evidence and leads recovery.

Test an unreachable primary contact. Document pre-authorized actions and exceptions. For industrial or clinical systems, obtain explicit operational approval for containment methods; a generic workstation-isolation policy is not enough. Check whether the supplier provides investigation only, remediation, forensic support or full recovery coordination.

Contact: duty manager, identity administrator, operations/clinical leader, broker and counsel. Exit criterion: named primary and backup contacts plus an approved action matrix. Pitfall: discovering during an incident that the “response” service can only send an email.