# Build an incident response playbook for one type of attack

Creates a step-by-step playbook for a specific threat like ransomware or account takeover, with roles and decision points.

- Topic: Projects & Operations
- Framework: Few-Shot
- Level: Standard
- Tags: Legal, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/build-an-incident-response-playbook-for-one-type-of-attack

## Prompt

```text
Build an incident response playbook for one attack scenario.

**Scenario:** [e.g. "ransomware on a file server", "business email compromise", "compromised admin account", "lost laptop with sensitive data"]
**Our environment:** [key systems, identity provider, EDR, backup tool, cloud platforms]
**Team and roles:** [who is on call, IT, security, legal, comms, leadership, outside IR firm or insurer]
**Constraints:** [e.g. "24/7 operations", "regulated data", "cyber insurance requires notice within X hours"]

Structure it around the NIST incident response phases:
1. Detection and triage: signals that trigger this playbook, initial severity criteria, who to page.
2. Containment: immediate steps (with the order that preserves evidence), and the decisions that need an approver (e.g. shutting down production).
3. Evidence preservation: what to capture before changing anything, and chain of custody basics.
4. Eradication and recovery: removing the attacker, rotating credentials, restoring from clean backups, verifying before reconnecting.
5. Communication: internal updates cadence, when to involve legal, insurer, law enforcement, customers, or regulators.
6. Post-incident: lessons learned meeting and control improvements.

Include decision points as "If X, then Y" lines, and for each step: owner, tool, and target time.

Return: a one-page quick-reference checklist, the full playbook, and a contact roster template with [ADD] placeholders. Flag steps that need legal advice (e.g. ransom payment, breach notification) rather than making those calls.
```

## What to fill in

- ADD

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.