Carrollton, TX

Hire Experts

Related Cendien services

Managed CybersecurityThreat detection, HIPAA, SOC 2 and CMMC.

Managed ComplianceHIPAA, SOC 2, CMMC and NIST programs.

Technology AssessmentIT audit, gap analysis and a roadmap.

Related insights

Cybersecurity Threats in 2026: What You Need to KnowStay ahead of evolving cyber threats with insights into the latest attack vectors and defense strategies.

Implementing Zero Trust: A Step-by-Step Guide for Enterprise ITA practical implementation guide for Zero Trust Architecture — from identity foundation to network micro-segmentation and continuous monitoring.

ResourcesCybersecurityChecklist

ChecklistCybersecurity

Incident Response Playbook & Checklist

NIST finalized SP 800-61 Revision 3 in April 2025. It supersedes Revision 2 and no longer treats incident response as a stand-alone lifecycle. Instead, it maps incident response activities to the six Functions of the NIST Cybersecurity Framework (CSF) 2.0: Govern, Identify, Protect, Detect, Respond and Recover. This playbook turns that guidance into a practical checklist you can adapt to your organization. It is a planning aid, not legal advice; confirm notification and reporting obligations with your counsel and any regulator, insurer or contract that applies to you.

Cendien Marketing

Practice Research Team

February 20257 min read Free Download

Listen to overview

Get This Resource

Download this resource free — no credit card required. Delivered instantly to your inbox.

Talk to an Expert

CybersecurityIncident ResponseNISTBreach

Aligned with NIST SP 800-61 Rev. 3 and the NIST Cybersecurity Framework 2.0

About this guide

1. Govern — set direction before an incident

An incident response policy is approved by leadership and reviewed at least annually.
Roles are named: incident lead, technical lead, communications lead, legal/privacy contact, executive decision-maker, and backups for each.
Decision authority is documented: who can isolate systems, take services offline, engage outside responders, contact law enforcement and approve public statements.

2. Identify — know what you are protecting

Current asset inventory covering servers, endpoints, network devices, cloud tenants, SaaS apps and data stores, with owners.
Critical services ranked (for example: 911/CAD, payroll, ERP, utility billing, student information, email) with acceptable downtime for each.
Data classified so responders know where sensitive and regulated data lives.

3. Protect — reduce likelihood and impact

Multi-factor authentication enforced for remote access, email, privileged accounts and cloud admin consoles.
Privileged access separated and reviewed; no shared admin accounts.
Patch and vulnerability management with defined timelines for critical issues; known-exploited vulnerabilities prioritized.

4. Detect — find incidents quickly

Alerts from EDR, identity, email and network tools flow to a monitored queue with 24/7 coverage (internal or provider).
Clear criteria for what becomes an incident, with severity levels (for example: Low / Moderate / High / Critical) tied to business impact.
Staff and users know how to report suspicious activity, and reports are acknowledged.

5. Respond — contain, analyze, communicate

Open an incident record with a timeline; assign an incident lead.
Preserve evidence: do not wipe or rebuild affected systems before capturing what investigators need.
Contain: isolate affected endpoints, disable compromised accounts, revoke sessions and tokens, block malicious indicators.

6. Recover — restore and improve

Restore from known-good backups, verifying integrity before reconnecting to the network.
Bring services back in priority order, with heightened monitoring.
Confirm the attacker no longer has access before declaring recovery complete.

Exercise plan

Quarterly: verify contact lists and on-call coverage.
Twice a year: tabletop exercise on a realistic scenario (ransomware, business email compromise or vendor compromise) with leadership in the room.
Annually: full restore test of a critical system from backup.

Quick reference — severity examples

Low: single phishing email reported, no click; blocked malware on one endpoint.
Moderate: one compromised user account with no evidence of data access.
High: multiple compromised accounts, confirmed access to sensitive data, or a critical service degraded.
Critical: ransomware spreading, critical public services down, or confirmed large-scale data exposure.

This page shows a summary. The complete checklist is in the branded PDF — download it above, it is free.

Sources

• NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management (April 2025) — csrc.nist.gov
• NIST Cybersecurity Framework 2.0 (February 2024) — nist.gov/cyberframework
• CISA Known Exploited Vulnerabilities Catalog and incident reporting — cisa.gov
• FBI Internet Crime Complaint Center — ic3.gov

How Cendien helps

Cendien supports public-sector and mid-market IT teams with managed IT services, service desk, and cybersecurity operations. If you want help reviewing your incident response plan or running a tabletop exercise, contact us at (214) 245-4580 or cendien.com/contact.

Topics Covered

CybersecurityIncident ResponseNISTBreachSecurity Operations