Computer Security Incident Handling Guide¶
Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide. National Institute of Standards and Technology.
Cited by¶
13 citations across 13 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Escalation Dominance
- In cybersecurity, incident-response playbooks map escalation ladders from notice through deplatform to prosecution.
This sourceSpecifies incident-response procedures and escalation from notification and analysis through containment to coordination with outside parties and law enforcement. DOI resolves to the correct NIST publication.
Supported in partVerified against the work's full text
NIST SP 800-61r2 covers incident notification, internal escalation, containment decisions and evidence for prosecution, but no escalation ladder ending in deplatforming and prosecution.
“the caller should escalate the incident to a higher level, such as the incident response team manager.”
- In cybersecurity, incident-response playbooks map escalation ladders from notice through deplatform to prosecution.
- Event Lifecycle Phases
- Cybersecurity: hardening / incident response / post-incident review, where pre-event work is invisible until it pays off, the response is high-tempo and visible, and the post-event phase is where organisational learning happens or fails to.
This sourceDefines the incident-response lifecycle — preparation, detection and analysis, containment/eradication/recovery, and post-incident activity — the cybersecurity hardening/response/review trichotomy.
Supported in partVerified against the work's full text
NIST SP 800-61r2 defines the preparation, response and post-incident phases and calls learning from incidents the most often omitted step; the visibility claims are not in it.
“One of the most important parts of incident response is also the most often omitted: learning and improving.”
- Cybersecurity: hardening / incident response / post-incident review, where pre-event work is invisible until it pays off, the response is high-tempo and visible, and the post-event phase is where organisational learning happens or fails to.
- Incident Response
- Cybersecurity incident response: the NIST IR cycle (Detection & Analysis → Containment, Eradication, Recovery → Post-Incident Activity) and the SANS PICERL model carry the skeleton, with containment-before-eradication as the load-bearing inversion — a compromised host is isolated before the attacker is removed.
This sourceThe detection-and-analysis → containment, eradication, recovery → post-incident cycle, with containment-before-eradication and forensic-state preservation as load-bearing moves.
Supported in partVerified against the work's full text
NIST 800-61r2 gives the phase cycle and says eradication follows containment, but contains no SANS PICERL model.
“After an incident has been contained, eradication may be necessary to eliminate components of the incident, such as deleting malware and disabling breached user accounts”
- Cybersecurity incident response: the NIST IR cycle (Detection & Analysis → Containment, Eradication, Recovery → Post-Incident Activity) and the SANS PICERL model carry the skeleton, with containment-before-eradication as the load-bearing inversion — a compromised host is isolated before the attacker is removed.
- Objective Creep
- In cybersecurity, an incident response scoped to contain one intrusion expands to broader threat hunting and architecture redesign during the incident, which becomes harder to close.
This sourceDescribes the containment-eradication-recovery lifecycle in which new information uncovered during containment sends responders back to detection/analysis to re-scope, the source of incident-response scope expansion.
Supported in partVerified against the work's full text
NIST 800-61r2 says containment and eradication often cycle back to detection to find more affected hosts, but does not describe expansion into threat hunting, redesign or harder closure.
“During this phase, activity often cycles back to detection and analysis”
- In cybersecurity, an incident response scoped to contain one intrusion expands to broader threat hunting and architecture redesign during the incident, which becomes harder to close.
Domain-specific¶
- Incident Objectives
- Public-health emergency response — outbreak-control objectives (case identification, contact-tracing throughput, vaccination coverage, surge capacity) re-set by the EOC each shift. Cyber incident response — containment, eradication, and recovery objectives per response cycle, set by the CISO, with CSIRT playbooks literally adopting ICS-202 templates.
This sourceNIST guide defining the incident-response life cycle and the containment, eradication and recovery phases within it.
Supported in partVerified against the work's full text
“detection and analysis, containment, eradication and recovery, and post-incident activity”
- Public-health emergency response — outbreak-control objectives (case identification, contact-tracing throughput, vaccination coverage, surge capacity) re-set by the EOC each shift. Cyber incident response — containment, eradication, and recovery objectives per response cycle, set by the CISO, with CSIRT playbooks literally adopting ICS-202 templates.
- Operational-Pause Mismanagement
- This is why modern DFIR practice prizes minimizing attacker dwell-time and often contains fast — cutting credentials and network access decisively — before completing a leisurely forensic investigation, precisely so the investigation interval does not become the attacker's opportunity
Supported in partVerified against a saved copy of the source
“Containment is important before an incident overwhelms resources or increases damage.”
- This is why modern DFIR practice prizes minimizing attacker dwell-time and often contains fast — cutting credentials and network access decisively — before completing a leisurely forensic investigation, precisely so the investigation interval does not become the attacker's opportunity
- Volunteer-Management Overload
- Analogous dynamics appear in hospital incident command after mass-casualty events, search-and-rescue operations, and cybersecurity incident response where offers of outside help arrive without trust paths or scoped access
This sourceNIST's incident-handling guide, which directs organisations to coordinate and share information with outside parties through established relationships and scoped, policy-governed channels.
Supported in partVerified against a saved copy of the source
“Organizations often need to communicate with outside parties regarding an incident, and they should do so whenever appropriate, such as contacting law enforcement, fielding media inquiries, and seeking external expertise.”
- Analogous dynamics appear in hospital incident command after mass-casualty events, search-and-rescue operations, and cybersecurity incident response where offers of outside help arrive without trust paths or scoped access
Mechanisms¶
- Containment or Rollback Action
- The discipline that guards against this is verifying reversibility before acting, preserving evidence as you go
This sourceDirects incident handlers to preserve evidence during response and treats containment as time for diagnosis.
- The discipline that guards against this is verifying reversibility before acting, preserving evidence as you go
- Critical-Moment Playbook
- When a breach is confirmed at 2 a.m., the team fills the blanks and runs each segment on its own clock, instead of drafting legally sensitive language under pressure.
This sourceRecommends predetermining incident-communication rules, recipients, timing, and legal/public-affairs procedures before an incident so urgent communications can proceed quickly without inventing sensitive policy during response.
- When a breach is confirmed at 2 a.m., the team fills the blanks and runs each segment on its own clock, instead of drafting legally sensitive language under pressure.
- Incident Phase Playbook
- The whole arc follows a recognized incident-handling lifecycle.
This sourceDefines an incident-response lifecycle spanning preparation, detection and analysis, containment-eradication-recovery, and post-incident activity.
- The whole arc follows a recognized incident-handling lifecycle.
- Rollback Checkpoint and Containment Runbook
- The runbook spells out the rest — the trigger (checkout error rate or auth-decline rate crossing a threshold), the exact revert steps, the containment move (flip the flag so only in-flight sessions on the new path are affected while everyone else is already back on the old one),
This sourceRequires incident-response procedures to provide detailed steps covering every phase of incident handling.
- The runbook spells out the rest — the trigger (checkout error rate or auth-decline rate crossing a threshold), the exact revert steps, the containment move (flip the flag so only in-flight sessions on the new path are affected while everyone else is already back on the old one),
- Stakeholder-Specific Brief
- The company treats the incident fact base as a single source of truth
This sourceRecommends maintaining a current incident-status statement so outward communications remain consistent and up to date.
- The company treats the incident fact base as a single source of truth
- War Room / Incident Channel
- Access is deliberately restricted to need-to-know; everyone treats the channel as on-the-record and preserved; and sensitive artifacts — credentials, customer data — are handled by reference, not pasted in the clear.
This sourceRecommends restricting incident information to authorized personnel and maintaining records of incident facts, communications, and actions.
- Access is deliberately restricted to need-to-know; everyone treats the channel as on-the-record and preserved; and sensitive artifacts — credentials, customer data — are handled by reference, not pasted in the clear.
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Read against the text for 7 of 13 citations: 7 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:805f9269b277 · see in the full table