Compliance · Incident response · Component
The response plan
Containment, roles, notification deadlines and who decides — settled in advance, because the clock runs during the incident.
The deliverable
What it is
Notification deadlines are short and they start when the organisation becomes aware, not when it finishes investigating.
The instinct to establish what happened before telling anyone is the failure mode where a deadline applies, and it converts a containable incident into a compliance breach as well.
One level in
What it is made of
Each element is a constituent part of the component. Follow one to see the attributes it carries.
The containment
What is done first to stop the harm.
3 attributes: Containment action · Pre-authorised · Within
LearnThe notifications
Who must be told, within how long, and what starts the clock.
3 attributes: Must notify · Deadline · Clock starts on
Learn
Contain first, notify on time, investigate after. The instinct to understand before telling anyone is the failure mode.
The other components in incident response
The incident definition
What counts as an incident, at what severity, written before one happens — so recognising it is not itself a judgement under pressure.
LearnThe post-incident review
Root cause and what changed, kept separate from the incident record itself so that learning is not mixed with the account of events.
Learn