incident_response

Name: incident_response
Author: alirezarezvani

Incident Response Reference (Executive Playbook)

Content Preview

# Incident Response Reference (Executive Playbook)

This is the executive IR playbook — strategic decisions, communication, and leadership during incidents. For technical playbooks (containment procedures, forensics), see your SOC runbooks.

---

## 1. Incident Classification

### Severity Levels

| Severity | Definition | Examples | Response Time | Escalation |
|---|---|---|---|---|
| SEV-1 (Critical) | Confirmed breach, data exfil, ransomware, production down | Active ransomware, confirmed dat

How to Use

Recommended: Install to project (local)

mkdir -p .claude/skills
curl -o .claude/skills/incident_response.md \
  https://raw.githubusercontent.com/alirezarezvani/claude-skills/main/c-level-advisor/ciso-advisor/references/incident_response.md

Skill is scoped to this project only. Add .claude/skills/ to your .gitignoreif you don't want to commit it.

Alternative: Clone full repo

git clone https://github.com/alirezarezvani/claude-skills

Then reference at c-level-advisor/ciso-advisor/references/incident_response.md