Cyber Incident Response Plan Organisation:

Risk Level Evaluation Emergency Key Co

Level Label Risk character Typical level of response Role
The issues experienced or anticipated have Board level involvement. Coordination Board level
the potential to halt all critical operations with appropriate government agencies.
and processes for an extended period of Implementation of DRBC Plan. Chairman
1 Strategic
time. etc.

There is likely to be an observable Board level involvement. Possible

2 Severe
3 Elevated
4 Operational
degradation of key services or operations
with the potential to affect share value or
reputation.
There is likely to be a measureable impact
on internal operations and processes, but
the risk to share value or reputation is
considered low.
There is unlikely to be any measureable
impact on internal operations or processes
and no impact on share value or reputation
is anticipated.
coordination with Police/other. Review of
DRBC Plan. Execution of Media and Social
Media plans.
C-Level
CXO involvement. Re-read and discussion CXO
of DRBC Plan. Coordination with PR team.
Police involvement only if appropriate. No CFO
media contact made. CIO
CTO
Appropriate C-level involvement or COO
reporting. Departmental level operational
responses and containment. Normal Etc.
business processes continue.

Operational
Critical Infrastructure Security Head
Type Location Description Risk Head
Fraud Head
Etc.
 External
Police
Information Comm.
PR Firm
Etc.

Action Plan
Risk Level
Actions (all as per organisation's cyber security plan) Locations
4 3 2 1
Backup data to removable storage x x x x
Move backups to DRBC site(s) x x
Halt key processes x
Shut down equipment x
Recover log files x x x
Execute Contact Plan x x x
Etc.
 Dept. or Team:

Emergency Key Contact List

Role Name Email address Mobile Phone
Board level
Chairman
etc.

C-Level
CXO

COO
Etc.

Operational
Security Head
Risk Head
Fraud Head
Etc.
External
Police
Information Comm.
PR Firm
Etc.

Locations Remarks