- Scope · systems and data covered: [the enclave, named]
- Definitions · an incident involving Specified Information is [unauthorized access, loss, disclosure, or suspected compromise of the data or the systems holding it]
- Roles · incident lead [name]; deputy [name]; IT or MSP contact [name]; management contact [name]
- Contacts · prime contractor security contact [name, channel]; contract-required government reporting contact [per clause]; cyber insurer [policy, number]; legal [name]
- Detection · where alerts arrive: [EDR console, log server, user reports to incident lead]
- Containment · isolate affected systems from the network; do not power off; preserve logs and images
- Eradication · confirm scope from logs; rebuild affected systems from baseline
- Recovery · restore from tested backups; verify before reconnecting to the enclave
- Reporting · what gets reported to whom, by when: [per contract clause; per Breach of Security Safeguards Regulations if personal information is involved]
- Review · what changed in controls afterward; entry in the remediation register
Exercise: annual tabletop, [date], attendance and scenario recorded. Plan distributed to: [roles]. Plan classification: internal, not published.