{ "schemaVersion": "1.0.0", "plan": { "id": "example-org-incident-response-plan", "title": "Example Organization Incident Response Plan", "organization": "Example Organization", "status": "draft_for_review", "version": "0.4.0", "effectiveFrom": "2026-08-01", "reviewedAt": "2026-07-15", "timezone": "UTC", "ownerRoleId": "incident-coordinator", "approverRoleId": "executive-owner", "disclosure": "Fictional planning example. It contains reserved document references and no real contacts, credentials, incident facts, customer data, evidence, legal conclusions, or assurance." }, "scope": { "included": [ "Coordination decisions from validated detection through response and the recovery handoff", "Severity classification, activation, deactivation, communication review, exercises, and improvement" ], "excluded": [ "Active containment commands, incident records, investigation evidence, and public status operations", "Disaster recovery procedures, business continuity arrangements, security-control verification, and legal determinations" ] }, "roles": [ { "roleId": "incident-coordinator", "title": "Incident coordinator", "responsibilities": [ "Coordinate classification, activation, decision records, handoffs, and scheduled reviews", "Confirm that owners and backups acknowledge their current responsibilities" ], "authority": [ "Activate or deactivate the plan when the documented criteria are met", "Assign coordination actions without replacing specialist decision authority" ], "backupRoleId": "operations-lead" }, { "roleId": "operations-lead", "title": "Operations lead", "responsibilities": [ "Own service-impact assessment and the handoff to separately controlled recovery procedures", "Coordinate current provider responsibility and escalation references" ], "authority": ["Recommend severity and recovery entry based on reviewed operational evidence"], "backupRoleId": "incident-coordinator" }, { "roleId": "security-lead", "title": "Security response lead", "responsibilities": [ "Own separately controlled technical response runbooks and technical findings", "Provide minimum-purpose facts for severity and coordination decisions" ], "authority": ["Authorize technical response actions through the approved runbook process"], "backupRoleId": "incident-coordinator" }, { "roleId": "communications-lead", "title": "Communications lead", "responsibilities": [ "Prepare audience-appropriate communication options from reviewed facts", "Keep public status operations separate from this plan" ], "authority": ["Release communications only after the required organizational reviews"], "backupRoleId": "executive-owner" }, { "roleId": "qualified-reviewer", "title": "Qualified legal and privacy reviewer", "responsibilities": [ "Determine applicable notification, disclosure, preservation, and coordination duties from current facts", "Record decisions in the controlled matter system rather than this plan" ], "authority": ["Advise authorized decision owners within the applicable context"], "backupRoleId": "executive-owner" }, { "roleId": "executive-owner", "title": "Executive incident owner", "responsibilities": [ "Own cross-functional priorities and unresolved business-risk decisions", "Confirm recovery exit and follow-up ownership when applicable" ], "authority": ["Approve the adapted plan through the organization's controlled process"], "backupRoleId": "incident-coordinator" } ], "severityLevels": [ { "code": "sev-1", "rank": 1, "label": "Critical coordination", "definition": "Credible evidence indicates severe or expanding business impact that requires immediate cross-functional ownership.", "activationSignals": [ "Material interruption across multiple critical services", "Credible high-impact unauthorized access requiring qualified review" ], "responseTarget": "organization_defined", "executiveReviewRequired": true }, { "code": "sev-2", "rank": 2, "label": "Major coordination", "definition": "Credible evidence indicates substantial bounded impact or a meaningful likelihood of escalation.", "activationSignals": [ "Sustained critical-service degradation", "Confirmed compromise with bounded known scope" ], "responseTarget": "organization_defined", "executiveReviewRequired": true }, { "code": "sev-3", "rank": 3, "label": "Focused coordination", "definition": "A validated event needs named coordination but has limited observed impact and a bounded current scope.", "activationSignals": [ "Localized service impact requiring multiple owners", "Suspicious activity validated for structured investigation" ], "responseTarget": "organization_defined", "executiveReviewRequired": false } ], "activation": { "criteria": [ "A validated event meets one severity definition and requires coordination across at least two owner roles", "A specialist owner requests plan activation because impact or responsibility boundaries are uncertain" ], "activationAuthorityRoleIds": ["incident-coordinator", "executive-owner"], "deactivationCriteria": [ "Immediate response decisions have owners and no unresolved action requires incident-level coordination", "Recovery, investigation, communication, and improvement work has an accepted controlled handoff" ], "deactivationAuthorityRoleIds": ["incident-coordinator", "executive-owner"] }, "responsibilityBoundaries": [ { "partyId": "example-org-platform-team", "partyType": "internal", "ownerRoleId": "operations-lead", "responsibilities": [ "Assess service impact and coordinate the recovery-plan handoff", "Maintain approved operational channel and provider escalation references" ], "inboundChannelRef": "https://coordination.example.test/channels/platform-intake", "outboundChannelRef": "https://coordination.example.test/channels/platform-escalation" }, { "partyId": "example-hosting-provider", "partyType": "provider", "ownerRoleId": "operations-lead", "responsibilities": [ "Provide incident coordination through the currently reviewed contractual support path", "Return provider-owned service facts through the approved minimum-purpose channel" ], "inboundChannelRef": "https://provider.example.test/support/incident-intake", "outboundChannelRef": "https://coordination.example.test/channels/provider-updates" } ], "communicationDecisions": [ { "eventType": "internal-leadership-update", "audience": "Authorized internal leadership", "ownerRoleId": "communications-lead", "reviewerRoleIds": ["incident-coordinator", "executive-owner"], "channelRef": "https://coordination.example.test/channels/leadership-update", "timing": "organization_defined_after_review", "reviewStatus": "requires_qualified_review", "notes": "Use verified minimum-purpose facts and record unresolved uncertainty without outcome assurance." }, { "eventType": "external-notification-review", "audience": "Potentially affected external parties", "ownerRoleId": "qualified-reviewer", "reviewerRoleIds": ["communications-lead", "executive-owner"], "channelRef": "https://coordination.example.test/decisions/external-notification", "timing": "organization_defined_after_review", "reviewStatus": "requires_qualified_review", "notes": "Determine applicable duties from current facts, agreements, jurisdiction, and qualified review; this plan sets no universal deadline." } ], "evidenceGovernance": { "ownerRoleId": "security-lead", "minimumRecords": [ "Timestamped decision references", "Source-system and collection-method references", "Integrity and access-review references where applicable" ], "handlingRules": [ "Keep evidence and sensitive incident facts in the approved controlled repository", "Collect, preserve, disclose, and dispose only under current owner-reviewed procedures" ], "retentionPolicyRef": "https://policy.example.test/records/incident-retention", "accessPolicyRef": "https://policy.example.test/access/incident-evidence" }, "runbookReferences": [ { "runbookId": "credential-misuse-runbook", "title": "Credential misuse response runbook", "scenario": "Suspected misuse of a workforce or service credential", "ownerRoleId": "security-lead", "documentRef": "https://runbooks.example.test/security/credential-misuse", "reviewedAt": "2026-07-10" }, { "runbookId": "service-disruption-runbook", "title": "Service disruption response runbook", "scenario": "Sustained service disruption requiring provider coordination", "ownerRoleId": "operations-lead", "documentRef": "https://runbooks.example.test/operations/service-disruption", "reviewedAt": "2026-07-10" } ], "recoveryGovernance": { "ownerRoleId": "operations-lead", "businessOwnerRoleId": "executive-owner", "recoveryPlanRef": "https://recovery.example.test/plans/platform-recovery", "entryCriteria": [ "Immediate containment decisions are owned and the recovery owner accepts the current handoff", "Known evidence-preservation constraints are recorded in the controlled coordination record" ], "validationCriteria": [ "Asset owners validate restored behavior against the separately approved recovery procedure", "Security and operations owners review relevant integrity evidence before production use" ], "exitCriteria": [ "Business and recovery owners accept documented service restoration for the bounded scope", "Unresolved investigation, communication, risk, and improvement work has a named owner and record" ] }, "exercises": [ { "exerciseId": "tabletop-provider-coordination-2026-q3", "type": "tabletop", "scheduledAt": "2026-09-15", "ownerRoleId": "incident-coordinator", "objectives": [ "Review activation and severity decisions with a fictional provider-originated event", "Verify the responsibility and communication handoff without using production data" ], "recordRef": "https://exercises.example.test/records/provider-coordination-2026-q3", "status": "planned" } ], "review": { "cadence": "quarterly_and_after_trigger", "nextReviewAt": "2026-10-15", "triggers": [ "Material role, provider, architecture, threat, incident, or applicable-requirement change", "Exercise or incident finding that changes coordination, authority, or handoff assumptions" ], "ownerRoleId": "incident-coordinator" }, "changeHistory": [ { "version": "0.4.0", "changedAt": "2026-07-15", "changedByRoleId": "incident-coordinator", "summary": "Added provider responsibility, communication review, evidence governance, and recovery handoff fields for fictional review.", "reviewStatus": "requires_qualified_review" } ] }