Incident Response Playbook: NCSC Guidance & NIST CSF 2.0

Build your incident response playbook aligned to NCSC guidance and NIST CSF 2.0

Your playbook must be simple enough to use during an incident yet complete enough to drive consistent decisions. The structure below ties NCSC-aligned incident management to NIST CSF 2.0 so you can show governance, traceability and continual improvement.

Define severity and triggers

• Severity levels: critical, high, medium, low — based on data sensitivity, service impact, regulatory exposure, and customer effect.
• Clear triggers: e.g., confirmed unauthorised access to privileged accounts, widespread malware, or service outage affecting core revenue processes.
• Response posture by level: immediate all-hands vs. business-hours handling; specify decision rights for containment steps that may disrupt services.
• Escalation paths: who approves isolation, takedown, notifications, and external engagement (vendors, law enforcement where appropriate).

Roles and responsibilities (RACI)

• Incident Commander (IC): leads response, sets priorities, approves containment and closure.
• Technical Lead: coordinates analysts and engineers, validates eradication and recovery.
• Communications Lead: stakeholder updates, customer messaging, media coordination when required.
• Legal/Privacy/HR: regulatory checks, contracts, employee considerations, and evidence oversight.
• Service/Business Owner: impact input and recovery acceptance.
• SOC Analyst/Responder: triage, investigation, documentation, and runbook execution.

Runbooks for common incidents

Templates you can copy into your document

Hands-on labs: tabletop and alert-to-response

Tabletop drill: targeted email compromise

• Scenario injects: suspicious login, forwarding rule, vendor payment request.
• Decisions: when to isolate, who to notify, what to say to the vendor.
• Artifacts: mocked SIEM alerts, mailbox rules export, change tickets.
• Outputs: updated severity triggers, refined comms templates, new detection.

SIEM alert-to-response lab

Set up a small lab to practise end-to-end triage and containment. You can build a home SOC lab and wire in Windows/Linux logs, identity events and endpoint telemetry.

• Create an alert use case (e.g., suspicious admin sign-in or rapid file encryption).
• Generate test data; confirm alert fidelity and enrichment fields.
• Work the playbook: classify severity, assign roles, contain, document.
• Capture timeline and evidence; run AAR and update the runbook.

Skills that reinforce your playbook