Security · phase
Phase 4: Respond
Plan incident response, forensic readiness, communication, containment, and lessons learned.
Purpose
The Respond phase prepares the organization to handle security incidents effectively. It covers incident response planning, forensic readiness, stakeholder communication, containment strategies, and post-incident review processes.
Skills
Incident Response
/security-incident-response <topic>Creates a comprehensive incident response plan. Covers incident classification, severity levels, response team roles, escalation procedures, and step-by-step response playbooks.
.singularskills/security/<topic>/04-respond.mdForensic Readiness
/security-forensic-readiness <topic>Establishes forensic readiness capabilities. Covers evidence preservation procedures, chain of custody requirements, forensic tooling, and legal hold processes.
.singularskills/security/<topic>/04-respond.mdIncident Communication
/security-incident-communication <topic>Develops incident communication templates and procedures. Covers internal notifications, customer communications, regulatory notifications, media responses, and status page updates.
.singularskills/security/<topic>/04-respond.mdContainment Strategy
/security-containment-strategy <topic>Defines containment strategies for different incident types. Covers network isolation, account lockdown, service degradation procedures, and rollback strategies.
.singularskills/security/<topic>/04-respond.mdLessons Learned
/security-lessons-learned <topic>Establishes post-incident review processes. Covers blameless postmortem templates, root cause analysis methods, improvement tracking, and knowledge base updates.
.singularskills/security/<topic>/04-respond.md