Building an Incident Response Plan

Just like you have a plan for back-up and disaster recovery (you do, don't you?), you should have a plan for response to computer crime incidents. This will help you take the right steps, both in advance of an incident and after it, to make sure you have the right groundwork laid and don't shoot yourself in the foot. This is a large subject area and there are whole books on the subject, but basically you want to document a process for dealing with incidents so you can proceed without uncertainty when something happens.

With input from upper management, build a map that lays out your actions if certain things occur. Make sure you have the proper approvals from upper management to do certain things like involve law enforcement, or your job could be at risk. In larger companies this will probably involve lawyers and the public relations department, and this may quickly be taken out of your hands, which is fine as long as you understand your role in the process and that is clear to everyone. This action plan might look something like this in its basic form.