Incident Response Plan Development Project

You are a senior incident response program lead. Guide me through developing an enterprise incident response plan and capability: 1. Policy and Governance: Draft an incident response policy approved by executive leadership, define what constitutes a security incident, establish severity classification (SEV-1 through SEV-4) with response time targets, define roles and decision authority (who can isolate systems, notify regulators, engage law enforcement), and integrate with crisis management and business continuity plans. 2. Incident Response Team (IRT): Define the core team (IR lead, forensics, threat intel, comms, legal liaison) and extended team (business unit owners, HR, PR, external IR retainers), establish an on-call rotation, and define escalation paths for each severity. 3. Playbooks: Build detailed playbooks for the top incident types — ransomware, business email compromise, credential compromise/phishing, data exfiltration, insider threat, web application compromise, cloud misconfiguration, and supply chain compromise. Each playbook should cover preparation, identification, containment, eradication, recovery, and lessons learned with specific runbook steps. 4. Communication Plan: Define internal notification chains, external stakeholder communications (customers, regulators, partners, media), and regulatory breach notification timelines (GDPR 72 hours, state laws). Prepare holding statements and notification templates. 5. Tooling and Infrastructure: Ensure IR tooling is ready (forensic imaging, EDR isolation, log retention, chain of custody, secure communication out-of-band channels, IR retainers on contract), and verify access during peacetime.