Incident Response Templates
Playbooks, runbooks, and IR planning templates
Tabletop Exercise Pack
The IR exercise programme management system for a security team — 10 research-calibrated scenarios, 13 tabs of maturity scorecard, gap tracker and executive dashboard, and a 687-paragraph facilitator guide. For maturing your own IR practice over time; if you need a single ninety-minute session for a room of executives, the Executive Tabletop Exercise Kit is that.
2026 Ransomware Readiness Workbook
18 tabs of operational crisis preparedness — 80-control readiness assessment, 8 pre-built IR playbook cards with DO NOT lists, ransom decision framework with OFAC gate, and regulatory matrix covering all 2026 mandates.
CIRCIA 72/24 Reporting Readiness Pack
Know in ten minutes whether CIRCIA covers you, decide in one call whether an incident is reportable, and have the report drafted inside the first day — the two-gate covered-entity worksheet, the four-prong decision tree, the 72/24 clock runbook, and a report pre-fill with a JSON Schema twin for your SOAR. Built on the NPRM, with a free update when the final rule publishes.
CRA 24-Hour Reporting Clock
The clock starts 11 September 2026. The runbook for the 24 hours after you learn a vulnerability in your product is being exploited — the actively-exploited evidence test, the 24/72/14-day sequencer, field-complete ENISA notification drafts, the PSIRT/CSIRT RACI, and a CVD policy you can publish as-is.
Incident Response Runbook Library
18 runbooks × 3 formats (54 files) — complete IR runbook library covering every major 2026 threat scenario, from ransomware multi-extortion to vishing to Magecart. ZIP delivery with Word, PDF, and Markdown versions of every runbook.
Ransomware Preparation Checklist
The pre-incident checklist for ransomware preparedness — backup validation, identity hardening, IR contacts, communication templates, and the ransom decision questions to answer before an attack hits.
I've Been Breached — The First 72 Hours Command Kit
It's 6 a.m. and everything is encrypted. This is what you do, and what you don't — a printable Hour-Zero card with the call order (insurer before any vendor, because off-panel forensics can void coverage), a workbook computing 25 notification clocks from your discovery time, the eight-gate ransom decision, and eleven communications templates.