Build an incident response playbook for one type of attack
Creates a step-by-step playbook for a specific threat like ransomware or account takeover, with roles and decision points.
The prompt
Build an incident response playbook for one attack scenario.
Scenario: [e.g. "ransomware on a file server", "business email compromise", "compromised admin account", "lost laptop with sensitive data"]
Our environment: [key systems, identity provider, EDR, backup tool, cloud platforms]
Team and roles: [who is on call, IT, security, legal, comms, leadership, outside IR firm or insurer]
Constraints: [e.g. "24/7 operations", "regulated data", "cyber insurance requires notice within X hours"]
Structure it around the NIST incident response phases:
1. Detection and triage: signals that trigger this playbook, initial severity criteria, who to page.
2. Containment: immediate steps (with the order that preserves evidence), and the decisions that need an approver (e.g. shutting down production).
3. Evidence preservation: what to capture before changing anything, and chain of custody basics.
4. Eradication and recovery: removing the attacker, rotating credentials, restoring from clean backups, verifying before reconnecting.
5. Communication: internal updates cadence, when to involve legal, insurer, law enforcement, customers, or regulators.
6. Post-incident: lessons learned meeting and control improvements.
Include decision points as "If X, then Y" lines, and for each step: owner, tool, and target time.
Return: a one-page quick-reference checklist, the full playbook, and a contact roster template with [ADD] placeholders. Flag steps that need legal advice (e.g. ransom payment, breach notification) rather than making those calls.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Projects & Operations prompts
What to fill in
- ADD
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Find unnecessary approvals in a workflow and simplify sign-offsReviews every approval in a workflow, flags the ones that add delay without reducing risk, and proposes a leaner sign-off design with thresholds.
- Price and document a change order before doing extra workA change order with cost breakdown, schedule impact, and justification that the owner or GC can approve quickly.
- Build a punch list and closeout plan to finish the jobAn organized punch list by area and trade plus a closeout checklist for documents, inspections, and final payment.
- Request additional fees when an architecture or engineering client changes scopeAn additional services request that ties a client's change to the contracted scope, phase, and fee, before the extra work starts.