An Introduction to Cybersecurity Incident Response Planning

A cyber security incident can cause significant damage to an organization. It will wreak havoc on an environment and cost time, money, and diminish reputations.  According to IBM’s Cost of a Data Breach Report 2021, the average cost of a breach was an outstanding $3.61 million dollars. 38% of that cost was due to lost business.

Another incredible finding in this report is that organizations that formed and tested an incident response plan saw an average total cost that was $2.46 million less that organizations that did not. Developing an effective incident response plan can greatly optimize response times and reduce all costs associated with an incident.

What is an incident response plan?

In its simplest form it is a plan with a set of instructions to guide an organization through all steps of incident response. These steps usually include preparation, detection, analysis, containment, eradication, recovery, and post-incident activity. The incident response plan can help an organization develop, maintain, and evolve their incident response capabilities.

A four phase approach to incident response planning 

The National Institute of Standards and Technology (NIST) highlights Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity as the four key phases of Incident response. These should be detailed in the incident response plan for the organization.


The preparation phase is the foundation for the remaining phases and is focused on establishing an incident response capability. This includes identifying and training dedicated personnel for incident response, configuring the environment for detection and prevention of potential incidents, and educating users on incident response and reporting procedures.

Detection & Analysis

Detection is one of the most challenging parts of incident response for an organization. In 2021, it took an average of 287 days to identify and contain a data breach. For the detection phase in the incident response plan, specific processes and tools should be identified to monitor, detect, and alert on suspicious activity. This should include an incident reporting and tracking system to track an incident throughout the remaining phases and then archived for future reference. Analysis of a potential incident should have processes and procedures identified to determine the scope and severity of the incident and ways to collect, store, and preserve the data in relation to the incident.

Containment, Eradication & Recovery

The goal of containment is to stop the effects of the incident before it can cause any further damage. Tactics and techniques for containment will vary based on the type of incident, and maturity level of the incident response capabilities. Typical containment activities include system isolation, updating firewall filters, and resetting system credentials. The eradication and recovery objective is to return to normal operations as safely as possible. Eradication and recovery plans are also dependent upon the incident type, and incident response capabilities. These plans should offer processes and procedures for system remediation, system restoration, and vulnerability management.

Post-Incident Activity

Post-incident activity is a critical, and yet easily overlooked phase. The plan for this phase should be dedicated to finalizing incident documentation, including any official reports required by regulation or law. The plan should also include steps for integrating hardening techniques to prevent similar incidents, and a process for a lessons-learned analysis to enhance future incident response capabilities.

Incident Response Plan Testing

Another vital part of an incident response planning is testing. Testing an incident response plan can be as simple as a tabletop walkthrough, or as complex as third-party penetration testing. Ideally, more than one method of testing is utilized. Testing the incident response plan will help an organization identify critical gaps in the incident response plan before they become a major handicap during a live incident wreaking havoc on an environment. Something as simple as outdated contact information, or faulty equipment can give needless time to a threat causing exponential damage with each passing moment.

Contact Us

Contact 38North to learn more about how you can develop an incident response plan to not only meet requirements, but to safeguard your business.

Jeremiah Thompson

Director of Cloud Security Architecture

Jeremiah Thompson is 38North’s Director of Cloud Security Architecture. He leads 38North’s technical teams as they tackle engineering challenges and design secure, compliant cloud security architectures.

For over 18 years Jeremiah has helped clients in the commercial, defense and federal civilian sectors engineer secure solutions to modern cyber challenges. Prior to 38North, he served as a Director at Coalfire, one of the nation’s preeminent Third-Party Assessment Organizations (3PAOs). At Coalfire he led FedRAMP and DoD FedRAMP+ assessments supporting Fortune 500 organizations. He was also a Lead Information Security Compliance Auditor supporting the National Cancer Institute, and an Information Security Compliance Auditor at IBM.

Jeremiah currently holds CISSP, CISM, CAP, C|EH, Security+, Network+, CCSK and MCP certifications.

Andy Davidson

Senior Director of Cloud Security

Andy Davidson is Senior Director of Cloud Security at 38North. He leads 38North Senior Advisors as they prepare IaaS, PaaS and SaaS providers for the rigors of FedRAMP authorization. One of the nation’s most experienced FedRAMP practitioners, Andy has been supporting FedRAMP assessment and consulting efforts since the initial FedRAMP pilot project. He specializes in helping hyperscale Cloud Service Providers (CSPs) navigate FedRAMP requirements and successfully achieve Provisional Authorities to Operate (P-ATO).

Prior to 38North, Andy was Senior Director of FedRAMP and Assessment Services at Coalfire, one of the leading Third-Party Assessment Organizations (3PAOs). At Coalfire, he was responsible for growing the 3PAO practice and managing assessor teams in the execution of high profile assessments for Fortune 500 CSPs. He also helped start Veris Group’s 3PAO practice. Prior to Veris, Andy was an IT security consultant at Booz Allen Hamilton, supporting security assessments and engineering efforts across the federal government.

Linda Morales

Senior Director of Global Compliance

Linda Morales is the Senior Director of Global Compliance at 38North Security. She leads assessments for customers in the healthcare, federal and commercial spaces. She specializes in helping organizations prepare for and complete FISMA, FedRAMP and HIPAA assessments. She is adept at leading teams to deliver efficient, accurate security reviews that withstand scrutiny from federal regulators. Linda is also a recognized expert in Healthcare security, helping Health-IT providers secure and defend Protected Health Information (PHI).

Prior to 38North, Linda served as a Director at Endeavor Systems, where she played a key role growing the federal security services practice. She also served as Security Manager for the Federal Aviation Administration’s (FAA) enterprise-wide assessment program, with responsibility for 150+ systems across FAA.

Linda earned a BS in Computer Science and a Masters in Engineering Management, with a focus in Information Security, both from The George Washington University. She is also a Certified Information Systems Security Professional (CISSP), Project Management Professional (PMP), and a Registered Practitioner with the Cybersecurity Maturity Model Certification Advisory Board (CMMC-AB).

Spence Witten

Senior Advisor and Director of Business Development

Spence Witten is a 38North Senior Advisor and Director of Business Development. He serves as a trusted security advisor to 38North’s clients in the cloud services, healthcare, financial, defense and critical infrastructure communities.

Prior to 38North, Spence was Vice President of Global Sales at Lunarline. Spence led sales and marketing across ten cybersecurity business units, culminating in Lunarline’s acquisition by Motorola Solutions. Prior to becoming VP of Global Sales, Spence ran Lunarline’s US Federal Security Services practice, overseeing Lunarline’s defense, intelligence and federal civilian portfolio. He was also an early employee of Endeavor Systems. He played a key role in Endeavor’s rapid expansion in the federal, civilian, defense, and research and development markets, through to Endeavor’s successful acquisition.

An Adjunct Professor at Cleveland-Marshall College of Law, Spence serves on the Board of Directors for the Center for Cybersecurity and Privacy Protection at Cleveland State University. He is also a member of CyberOhio, the official cybersecurity advisory board for the Governor of Ohio.

Virginia Suazo

Senior Director of Cloud Security Advisory

Virginia Suazo is 38North’s Senior Director of Cloud Security Advisory. She is responsible for leading 38North’s cloud security and compliance efforts, with a speciality in helping global CSPs juggle multiple overlapping regulatory frameworks.

Before joining 38North, Virginia worked at a tech startup supporting the first and only Red Hat OpenStack Platform that is FedRAMP-authorized. She played a vital role in successfully obtaining FedRAMP Moderate and High authorizations for IaaS, PaaS, and SaaS systems, while supporting other certifications including DoD IL4/5, PCI DSS, HIPAA and HITECH. Her 15 years of cybersecurity experience also includes several tours supporting US federal agencies, including State Department, Department of Justice, Health and Human Services, Food and Drug Administration, General Services Administration and Department of Transportation.

Matt Earley


Matt Earley is 38North’s founder and President. He started 38North – the premier cloud security advisory company, in the US and internationally – to solve complex security challenges while developing trusted relationships with an elite client base.

For over 20 years Matt Earley has designed and implemented security solutions for the US and Australian federal governments, critical infrastructure, utilities, and for global finance and healthcare organizations. He focuses on lean security architecture design and prioritizing security efforts based on the critical needs of his clients.

Prior to founding 38North, Matt was the director of federal services at Endeavor Systems, where he was responsible for Endeavor’s largest business unit, serving the Federal Aviation Administration, Department of Homeland Security and some of the world’s largest security operations centers. He was also a Senior Manager in the Australian Department of Defense, where he represented Australasia on the Common Criteria Management Board.

Matt has a Bachelor of Engineering in computer engineering from the University of Canberra in Australia, and a Master’s in engineering management from George Washington University. He also is a Certified Information Systems Security Professional (CISSP) and Project Management Professional (PMP).