ResponseOps

ResponseOps, as this Atlas uses the label, is security incident response run as a standing capability. When an attacker is, or may be, inside your systems, a prepared team decides how and when to contain them, preserves evidence, finds the full scope, evicts them in one coordinated move, recovers from known-clean sources and meets the notification duties that started at discovery. It begins where triage ends: when an alert becomes a declared incident.

The label is not standard; the practice is. No incident-response standard or guide opened for this page uses “ResponseOps”. Current US guidance is NIST SP 800-61 Rev. 3 (April 2025), which recasts incident response as a profile of the NIST Cybersecurity Framework (CSF) 2.0;^[1] ISO/IEC 27035-1:2023 covers the same ground internationally,^[2] and its Part 3 is titled “Guidelines for ICT incident response operations”.^[3]

For incident-response (IR) leads and tier-3 analysts, CISOs, their legal, privacy and communications partners, and the engineers who get pulled in.

In an outage the cause does not fight back, so restoring fast is usually right. With an attacker, the obvious fix is often wrong:

• The attacker can watch. CISA advises isolating systems “in a coordinated manner and use out-of-band communication methods such as phone calls to avoid tipping off actors”.^[9]
• Fixes destroy facts. Powering down loses evidence held in memory;^[9] unplugging can trigger “deadman switches” that wipe evidence;^[10] NIST describes malware that may encrypt the disk once its periodic pings fail.^[11]
• Half an eviction is a warning shot. Adversaries “often have multiple persistent backdoor accesses”.^[12]
• Legal clocks start early: at awareness, not at the end of the investigation.
• The pace is fast. In Mandiant’s 2025 investigations the median time from initial access to hand-off to a second threat group was 22 seconds, down from more than 8 hours in 2022.^[13]

• Not command, triage, detection or intelligence, which the neighbours in At a glance own; lessons flow to them.
• Not backup or DR engineering. It decides when recovery is safe and from which point; the mechanics live elsewhere.
• Not legal advice or courtroom forensics. It covers forensic basics; NIST’s forensic guide is the starting point for more.^[14]
• Not attribution. Identifying the attacking host “can be a time-consuming and futile process”.^[11]

There is no “ResponseOps” movement; the practice’s lineage is summarised in methods and frameworks. NIST’s 2025 revision explains why the old circle broke: in 2012 incidents were relatively rare and narrow and usually handled within a day or two, whereas recovery now “often takes weeks or months”.^[1]

Acronyms. SOC: security operations centre. EDR, XDR and MDR: endpoint, extended and managed detection and response. SIEM: security information and event management. SOAR: security orchestration, automation and response. MTTA and MTTR: mean time to acknowledge and to resolve. CERT-In: India’s national computer emergency response team. OFAC: the US Treasury’s sanctions office. CIRCIA: a US critical infrastructure reporting act. HIPAA: the US health-privacy law. NIS2 and DORA: EU cybersecurity and financial-resilience laws.

Mental model: three clocks (this page’s framing). The attacker’s clock measures how fast they spread, steal or destroy; the business clock, how long services can be impaired; the legal clock, the deadlines that began at awareness. Most hard decisions trade one against another: watching longer helps scoping but feeds the attacker’s clock; restoring fast helps the business but can destroy the facts the legal clock needs.

flowchart TB
  SD["SecDataOps: telemetry"] --> DET["DetectionOps: detections"]
  TI["ThreatOps: intel and hunts"] --> DET
  DET --> SOC["SOC Ops: triage"]
  SOC -->|"declared incident"| RSP["ResponseOps: contain, scope, evict, recover"]
  INC["IncidentOps: command and comms"] <-->|"security workstream"| RSP
  RSP -->|"clean recovery point"| BK["BackupOps"]
  RSP -->|"failover decision"| DR["DisasterRecoveryOps"]
  RSP -->|"breach facts"| PRV["PrivacyOps"]
  RSP -->|"privilege, regulators"| LEG["LegalOps"]
  RSP -.->|"lessons: new detections"| DET
  TI -.->|"scoping hunts"| RSP
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef neutral fill:#f1f4f6,stroke:#5b7a87,color:#122029
  class RSP core
  class SD,DET,TI,SOC,INC,BK,DR,PRV,LEG neutral

These boundaries are this Atlas’s editorial distinctions; no standard draws them, and in a small company one person may hold several roles.

This charter is this Atlas’s proposal. Mission: end the adversary’s access and limit harm while preserving the facts needed for legal duties and learning.

1. Declare early, downgrade freely. PagerDuty’s public process: “Not Sure it’s a Security Incident? Trigger the process anyway.”^[17]
2. Assume the attacker reads your email. Out-of-band channels, a codename, need-to-know membership.^[12][17]
3. Collect before you change: “you should do collection first and analysis later”;^[10] record every time in UTC.
4. Scope before you evict, unless harm is in progress; then contain first and log the evidence cost.
5. Evict in one move, then watch for re-entry.^[12]
6. Recover from proven-clean sources and check restored assets before production use.^[1]
7. Treat clocks as managed facts: who decided awareness, when and why.
8. Name decision owners in advance, including who may disconnect or shut down assets.^[1]

Non-goals: attribution for its own sake, blame, and public statements without legal review.

NIST lists leadership, incident handlers, technology staff, legal, public affairs, HR, physical security and asset owners, and suggests “designating an incident lead for each incident”.^[1] Here the IR lead owns the security workstream; the incident commander from IncidentOps owns overall coordination when services are affected.

A = accountable, R = responsible, C = consulted, I = informed. An executive, not the IR lead, owns taking a revenue-critical service offline; legal, not engineering, owns whether and when to notify.

Rev. 3 maps the old phases onto the CSF 2.0 Functions. It treats Govern, Identify and Protect as broader risk management that also supports incident response, and Detect, Respond and Recover as response itself; it adds that organisations “should use the incident response life cycle framework or model that suits them best”.^[1]

flowchart LR
  subgraph OLD["Rev. 2 phases (2012)"]
    P["1. Preparation"]
    D["2. Detection and analysis"]
    C["3. Containment, eradication, recovery"]
    PI["4. Post-incident activity"]
  end
  subgraph NEW["Rev. 3: CSF 2.0 Functions (2025)"]
    G["Govern, Identify, Protect"]
    DE["Detect"]
    RS["Respond"]
    RC["Recover"]
    IM["Improvement (ID.IM)"]
  end
  P -.-> G
  D -.-> DE
  C -.-> RS
  C -.-> RC
  D -.-> IM
  C -.-> IM
  PI -.-> IM
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef neutral fill:#f1f4f6,stroke:#5b7a87,color:#122029
  class DE,RS,RC core
  class P,D,C,PI,G,IM neutral

For a capability: Day 0 builds policy, criteria, playbooks, retainers, out-of-band channels, an evidence store and log retention; Day 1 is each incident; Day 2 turns lessons into actions, detections and exercises, and keeps continuity and IR plans in step, as NIST asks.^[1]

• Severity. NIST warns against handling incidents “on a first-come, first-served basis” and lists risk factors: asset criticality, functional and data impact, stage of activity, threat actor and recoverability.^[1] See the severity matrix.
• Authority. The policy names who may disconnect or shut down assets.^[1] Pre-approve low-regret actions (isolating a laptop, disabling an account) so analysts act at night without waiting.
• Law enforcement. NIST ties notifying it to plan criteria and management approval;^[1] CISA suggests asking about decryptors and coordinating before eradication.^[9][12] Decide who calls, usually with counsel (see the FAQ).

The design rule that matters most: the response plane must not depend on the identity, email and chat systems the attacker may control. Mandiant reports ransomware operators targeting backup infrastructure, identity services and virtualisation management, and recommends decoupling backups from the corporate Active Directory domain.^[13]

Treat the directory, email, chat and endpoint management as possibly compromised until scoping clears them, and keep break-glass accounts outside the main identity provider, with credentials offline.

Happy path. The SOC escalates; the IR lead declares, opens a restricted case with a codename and records the awareness time; evidence is taken; scoping runs until no new footholds appear; eviction runs in one window; recovery uses clean points; notices go out on time; the after-action report closes the incident.

When an outage turns out to be an attack, the handoff below applies (an Atlas proposal shared with the IncidentOps page): the incident commander keeps overall coordination and hands the security workstream to the IR lead, whose evidence rules then constrain restores. PagerDuty also keeps an incident commander in charge of security incidents.^[17]

sequenceDiagram
  participant IC as Incident commander
  participant IR as ResponseOps lead
  participant LG as Legal and privacy
  IC->>IR: Security cause suspected, paging security on-call
  IR->>IC: Security workstream accepted, restricted channel
  IR->>LG: Possible breach, start clock assessment
  LG->>IR: Privilege and evidence instructions
  IR->>IC: Hold restores and rebuilds until evidence is taken
  IC->>IR: Business priorities for recovery
  Note over IR: Collect, scope, plan eviction
  IR->>LG: Facts - what, whose data, when known
  LG->>IR: Notification decisions and approved wording
  IR->>IC: Eviction done, restore from clean points
  IC->>IR: Services recovered, watch for re-entry

Exception paths. False positive: downgrade, record why, tell legal the clock analysis stopped. Harm in progress: contain at once, even at evidence cost, and log what was lost. The attacker reacts: return to scoping, as CISA’s playbooks do whenever new signs of compromise appear.^[12] A supplier is the source: invoke the contract.

NIST’s 2012 criteria remain a good checklist: potential damage and theft, the need to preserve evidence, service availability, time and resources, effectiveness, and how long the measure must last.^[11] Rev. 3 asks responders to balance quick recovery against the need “to observe the attacker or conduct a more thorough investigation”.^[1]

flowchart TB
  A["Incident declared"] --> B{"Harm in progress or imminent?"}
  B -- "Yes" --> C["Contain now; accept evidence loss; log it"]
  B -- "No" --> D{"Can the attacker see us?"}
  D -- "Possibly" --> E["Out-of-band only; small team"]
  D -- "Unlikely" --> F["Normal restricted channel"]
  E --> G["Capture volatile evidence from a sample"]
  F --> G
  G --> H{"Scope stable for a full cycle?"}
  H -- "No" --> I["Hunt and monitor; limited containment"]
  I --> H
  H -- "Yes" --> J["Coordinated eviction window"]
  C --> K["Re-scope after the emergency"]
  K --> H
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef decision fill:#fdf3e3,stroke:#c9800f,color:#122029
  classDef risk fill:#fbeceb,stroke:#b4332b,color:#122029
  class B,D,H decision
  class C risk
  class A,E,F,G,I,J,K core

Watching has a price. NIST says diverting an attacker to a sandbox delays containment, needs legal agreement first and “can be dangerous”;^[1] its 2012 guide warned that an organisation allowing a known compromise to continue “may be liable” if the system attacks others.^[11] Make “scope first” a time-boxed decision with an owner.

Technical traps:

• Stateful firewalls keep talking. On AWS, “When you change a security group rule, its tracked connections are not immediately interrupted”;^[23] only untracked flows (allowed by open rules in both directions) drop at once, and an outbound command-and-control connection is normally tracked. A new security group “has an outbound rule that allows all outbound traffic” until removed.^[24]
• Network ACLs cut connections, but bluntly. A deny breaks existing connections,^[23] yet it covers the whole subnet and matches remote addresses: deny the attacker’s addresses, numbered below the allow rules.^[25] ACLs miss traffic within the subnet, DNS to the Route 53 Resolver and the metadata service:^[26] add Resolver DNS Firewall, revoke the instance role’s sessions,^[27] or isolate the host with the EDR.
• Disabled accounts keep some access. In Microsoft Entra ID, disabling a user and revoking its tokens are continuous access evaluation (CAE) critical events, which Exchange, SharePoint and Teams enforce in near real time (up to 15 minutes); clients that are not CAE-capable keep a token for about an hour.^[28] Longer access usually comes from elsewhere: an app with application permissions, which runs without the user;^[29] forwarding or inbox rules;^[30] or a hybrid account disabled only on-premises (Microsoft’s procedure acts in both directories).^[31]
• Cloud sessions outlive the key. AWS temporary credentials “are valid until they expire” unless you also change permissions or attach a time-based deny.^[32][27]

NIST notes that formal chain-of-custody handling “might not be performed for every incident”, yet “collected incident data is still considered evidence”.^[1] Handle evidence formally whenever legal action, regulators, insurers or employment proceedings are possible.

flowchart TB
  A["Identify sources, most volatile first"] --> B["Collect with trusted tools"]
  B --> C["Hash at collection"]
  C --> D["Log: who, what, when (UTC), where"]
  D --> E["Seal and store a write-once copy"]
  E --> F["Transfer: re-hash and sign custody row"]
  F --> G{"Hash matches?"}
  G -- "Yes" --> H["Analyse a working copy"]
  G -- "No" --> I["Stop; record; tell the IR lead"]
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef decision fill:#fdf3e3,stroke:#c9800f,color:#122029
  classDef risk fill:#fbeceb,stroke:#b4332b,color:#122029
  class A,B,C,D,E,F,H core
  class G decision
  class I risk

RFC 3227 orders collection from registers and memory through temporary file systems and disk to remote logs and archives, asks collectors to note the difference between the system clock and UTC, and wants evidence that is admissible, authentic, complete, reliable and believable.^[10] NIST’s 2012 guide lists the log fields (identifiers, handlers, time with time zone, storage location) and signed custody forms at each transfer;^[11] SP 800-86 adds message digests and write-blockers.^[14] Run tools from trusted media, because the compromised system’s programs may lie.^[10] In cloud and SaaS services much of your evidence is the provider’s audit log, so arrange its retention and export before the incident.

CISA asks responders to account for “all means of persistent access” before eradication, coordinate it with service providers and law enforcement, and keep monitoring for re-entry.^[12] Its Eviction Strategies Tool builds a plan from the attacker’s observed techniques.^[15] In one window, typically:

• Revoke sessions and tokens for affected identities and all administrators; rotate compromised service credentials.
• After an Active Directory compromise, reset the krbtgt password twice, waiting 10 hours (the default maximum ticket lifetime) between resets.^[33] krbtgt is the account whose key signs every Kerberos ticket-granting ticket, so its secret is in effect the domain’s master key.
• Remove every persistence item found in scoping (tasks, accounts, OAuth grants, access keys, web shells), patch the entry point and raise monitoring on everything in scope.

NIST suggests procedures for the most common incident types and for urgent processes “such as redeploying the organization’s primary authentication platform”.^[1] Microsoft publishes playbooks for phishing, password spray, app consent grants and compromised applications.^[34] A sensible first set: ransomware and extortion, identity takeover, cloud credential compromise, business email compromise, and insider data theft.

Choose by job; test each tool with your directory and email down.

NIST suggests letting tools contain some threats automatically (quarantining malware, moving an endpoint to an isolated network, halting an infected container) while handlers can still choose actions manually.^[1] Automate collection and reversible, low-regret actions; keep a human on anything that destroys evidence, stops a revenue service or touches many identities. Never automate a wipe before collection. Language models can draft timelines, but statements to regulators must trace to evidence, and evidence must not go to public services; CISA warns that submitting malware samples to a public analysis service can tip off an attacker.^[12] Evaluating AI in security work is covered in AIOps for Security.

The pack assumes a mid-sized organisation with a 24×7 SOC (own or outsourced), an IR retainer, Microsoft Entra ID and AWS.

1. Severity matrix. Declare when any row is true; the highest row sets severity. Factors follow NIST;^[1] thresholds are illustrative.

2. A playbook as data. Structured playbooks are reviewable and versioned; the gates matter most: what must be true before a step runs, who approves it, which evidence comes first. Two AWS terms used below: an SCP (service control policy) caps what every principal in a member account may do, and an ENI (elastic network interface) is the virtual network card that carries an instance’s security groups.

Example status: YAML syntax-checked; not loaded into any tool; field names are this page’s own.

playbook: cloud-access-key-compromise
version: 4
applies_when: "AWS access key used from an unexpected network or identity"
severity_floor: SEV-2
roles: {lead: ir-lead, approver_containment: cloud-platform-owner, legal: privacy-counsel}
evidence_first:
  - id: E1
    what: "CloudTrail for the key and principal, first use to now, all Regions"
    look_first: [CreateAccessKey, CreateUser, CreateLoginProfile, UpdateAssumeRolePolicy]
  - id: E2
    what: "IAM export: users, roles, policies, keys, logins, MFA, certificates, trusts"
  - id: E3
    what: "Instance record (security groups, ENIs) and EBS snapshots, before any change"
steps:
  - id: S1
    action: "Deactivate EVERY access key of the principal; deny older sessions"
    gate: [E1, E2]
    approval: none   # pre-agreed low-regret action
  - id: S2
    action: "Revoke sessions of assumed and instance roles; SCP deny if it can write IAM"
    gate: [S1]
    approval: approver_containment
  - id: S3
    action: "Isolate instances: tested no-rule SG; NACL deny for attacker addresses"
    gate: [E3]
    approval: approver_containment
  - id: S4
    action: "Hunt: new keys, users, roles, trust changes, Lambda, unusual Regions"
    gate: [S1]
    approval: none
  - id: S5
    action: "Eviction window: remove persistence found in S4; rotate secrets in reach"
    gate: [S4]
    approval: ir-lead
decisions:
  - "Personal data in any bucket the key could read? -> legal clock assessment"
  - "Customer-facing service affected? -> page the incident commander"
exit_criteria:
  - "No activity from attacker infrastructure for 72 h after eviction"
  - "All S4 findings removed and verified"

3. Containment commands for S1 to S3, run from a break-glass session that can change IAM and EC2 in the affected account.

Example status: bash syntax-checked; JMESPath queries tested on sample JSON; not executed (requires an AWS account and the AWS CLI v2); identifiers are placeholders.

#!/usr/bin/env bash
set -euo pipefail
CASE="IR-2026-014"; USER_NAME="ci-deployer"
ROLES="ci-deploy-role"   # roles the principal assumed, from E1 (space-separated)
INSTANCE="i-0123456789abcdef0"
ISOLATION_SG="sg-0fedcba9876543210"   # pre-built and tested; must have no rules
OUT="evidence/${CASE}/aws"; mkdir -p "$OUT"   # case folder, not the working directory

# S1: deactivate EVERY key of the principal (the attacker may have created one)
aws iam list-access-keys --user-name "$USER_NAME" > "$OUT/access-keys-before.json"
for key in $(aws iam list-access-keys --user-name "$USER_NAME" \
    --query 'AccessKeyMetadata[].AccessKeyId' --output text); do
  aws iam update-access-key --user-name "$USER_NAME" \
    --access-key-id "$key" --status Inactive
done
# ...then deny credentials issued before a cutoff ~30 s ahead (AWS console margin)
NOW="$(date -u -d '+30 seconds' +%Y-%m-%dT%H:%M:%SZ)"
cat > "$OUT/deny-older.json" <<JSON
{"Version": "2012-10-17", "Statement": {"Effect": "Deny", "Action": "*",
 "Resource": "*", "Condition": {"DateLessThan": {"aws:TokenIssueTime": "$NOW"}}}}
JSON
aws iam put-user-policy --user-name "$USER_NAME" \
  --policy-name "deny-sessions-before-$CASE" \
  --policy-document "file://$OUT/deny-older.json"
# S2: the same deny on each role it assumed, as AWS's "revoke sessions" does
# (needs iam:PutRolePolicy; ends legitimate sessions too; not for service-linked
# roles; IAM Identity Center roles are revoked in Identity Center)
for role in $ROLES; do
  aws iam put-role-policy --role-name "$role" \
    --policy-name "deny-sessions-before-$CASE" \
    --policy-document "file://$OUT/deny-older.json"
done
# If the principal can change IAM, also attach an SCP deny from the management account

# E3 before S3: record groups and interfaces, protect the instance, snapshot volumes
aws ec2 describe-instances --instance-ids "$INSTANCE" > "$OUT/instance-before.json"
aws ec2 modify-instance-attribute --instance-id "$INSTANCE" --disable-api-termination
for vol in $(aws ec2 describe-instances --instance-ids "$INSTANCE" --output text \
    --query 'Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId'); do
  aws ec2 create-snapshot --volume-id "$vol" --description "$CASE evidence" \
    --tag-specifications "ResourceType=snapshot,Tags=[{Key=case,Value=$CASE}]"
done

# S3: refuse an isolation group with rules (new groups allow all outbound traffic)
rules="$(aws ec2 describe-security-groups --group-ids "$ISOLATION_SG" --output text \
  --query 'SecurityGroups[0].[length(IpPermissions),length(IpPermissionsEgress)]' \
  | tr -d '[:space:]')"
[ "$rules" = "00" ] || { echo "isolation group has rules: $rules" >&2; exit 1; }
# Swap groups per network interface (instance-level changes can fail with several)
for eni in $(aws ec2 describe-instances --instance-ids "$INSTANCE" --output text \
    --query 'Reservations[].Instances[].NetworkInterfaces[].NetworkInterfaceId'); do
  aws ec2 modify-network-interface-attribute --network-interface-id "$eni" \
    --groups "$ISOLATION_SG"
done
# Tracked connections survive: add network ACL denies for the attacker's addresses

Caveats from AWS’s documentation:

• A deny on aws:TokenIssueTime does not affect requests signed with long-term keys,^[27] so S1 deactivates every key. A principal that can change IAM can undo S1; an SCP restricts even administrators of a member account, though not the management account.^[38]
• Each assumed role needs its own revocation; roles from IAM Identity Center permission sets are revoked there.^[27]
• modify-instance-attribute can fail on instances with several network interfaces, hence the per-interface loop.^[39]

Deactivate rather than delete keys: deactivation is reversible, and the files in $OUT support rollback.

4. Identity takeover in Microsoft Entra ID, Microsoft’s emergency procedure with a placeholder user. It needs the User Administrator role (Privileged Authentication Administrator for admin accounts) and Cloud Device Administrator for devices.^[31] Then remove the attacker’s app consents, forwarding and inbox rules.^[30]

Example status: copied from vendor documentation; not executed (requires an Entra tenant and Microsoft Graph permissions).

Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.AccessAsUser.All"
$User = Get-MgUser -Search UserPrincipalName:'user@example.com' -ConsistencyLevel eventual
Update-MgUser -UserId $User.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $User.Id
Get-MgUserRegisteredDevice -UserId $User.Id -All |
  ForEach-Object { Update-MgDevice -DeviceId $_.Id -AccountEnabled:$false }

Directory.AccessAsUser.All is broad (the session acts with the signed-in administrator’s full directory rights); the roles above are the real limit. For a session-only revocation, Microsoft’s compromised-mailbox procedure connects with the narrower User.RevokeSessions.All.^[30]

The labs use synthetic data and need no cloud account. Labs 1–3 were executed from the code below on 2026-10-17 (Linux, GNU bash 5.0, coreutils 8.30, Python 3.8.10); the outputs shown come from those runs.

Objective: collect files as evidence, prove integrity at each transfer, detect tampering. Prerequisites: Linux with bash and sha256sum (on macOS use shasum -a 256 and stat -f %z); 30 minutes; no cost. Limit: exported files only; disk images need write-blockers and forensic tools.^[14]

1. Save the two scripts as evidence_intake.sh and custody_event.sh; make them executable.
2. Run mkdir exports and create two one-line files there, cloudtrail-extract.log and edr-extract.log.
3. Run ./evidence_intake.sh IR-2026-014 "A. Analyst" exports/*.log.
4. Run ./custody_event.sh IR-2026-014 IR-2026-014-001 transferred "A. Analyst to B. Examiner" "locker 3".
5. Make item 2 writable (chmod u+w), append a character, and repeat step 4 for IR-2026-014-002.
6. Create exports/proxy-extract.log, take it in with a second intake run, and repeat step 5’s custody event.

Example status: executed 2026-10-17; bash syntax-checked.

#!/usr/bin/env bash
# evidence_intake.sh CASE_ID HANDLER FILE...  (copy, hash once, log)
set -euo pipefail
case_id="$1"; handler="$2"; shift 2
store="evidence/${case_id}"
log="${store}/custody.csv"
mkdir -p "${store}/items"
[ -f "$log" ] || echo "utc_time,item_id,sha256,bytes,action,handler,source" > "$log"
n=$(( $(find "${store}/items" -name '*.bin' | wc -l) + 1 ))  # next item number
added=0
for src in "$@"; do
  case "$src" in *,*) echo "refusing path with a comma: $src" >&2; exit 2;; esac
  item="$(printf '%s-%03d' "$case_id" "$n")"
  orig="$(sha256sum "$src" | cut -d' ' -f1)"
  cp --preserve=timestamps "$src" "${store}/items/${item}.bin"
  chmod 0444 "${store}/items/${item}.bin"
  copy="$(sha256sum "${store}/items/${item}.bin" | cut -d' ' -f1)"
  if [ "$orig" != "$copy" ]; then echo "hash mismatch: $src" >&2; exit 1; fi
  bytes="$(stat -c %s "$src")"
  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
  echo "${now},${item},${copy},${bytes},collected,${handler},${src}" >> "$log"
  echo "${copy}  ${item}.bin" >> "${store}/SHA256SUMS"  # reference hash, written once
  n=$((n + 1)); added=$((added + 1))
done
echo "case ${case_id}: ${added} item(s) added, $((n - 1)) in total; log ${log}"

#!/usr/bin/env bash
# custody_event.sh CASE_ID ITEM_ID ACTION HANDLER NOTE  (re-verify, then log)
set -euo pipefail
case_id="$1"; item="$2"; action="$3"; handler="$4"; note="$5"
store="evidence/${case_id}"
sums="$(grep "  ${item}.bin\$" "${store}/SHA256SUMS" | cut -d' ' -f1 || true)"
logged="$(grep "^[^,]*,${item},[^,]*,[^,]*,collected," "${store}/custody.csv" \
  | cut -d, -f3 || true)"
have="$(sha256sum "${store}/items/${item}.bin" | cut -d' ' -f1)"
if [ "$sums" != "$have" ] || [ "$logged" != "$have" ]; then
  echo "INTEGRITY FAILURE: ${item} (stop; tell the IR lead)" >&2
  exit 1
fi
bytes="$(stat -c %s "${store}/items/${item}.bin")"
now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo "${now},${item},${have},${bytes},${action},${handler},${note}" \
  >> "${store}/custody.csv"
echo "logged ${action} for ${item}"

Expected output: step 3 prints case IR-2026-014: 2 item(s) added, 2 in total; log evidence/IR-2026-014/custody.csv; step 4 prints logged transferred for IR-2026-014-001; step 5 prints INTEGRITY FAILURE: IR-2026-014-002 (stop; tell the IR lead) and exits with 1. Step 6 adds IR-2026-014-003 (1 item(s) added, 3 in total), and item 2 still fails. Validation: (cd evidence/IR-2026-014/items && sha256sum -c ../SHA256SUMS) shows OK for items 1 and 3 and FAILED for item 2. Reference hashes are written once, at collection, and each transfer checks both SHA256SUMS and the collection row; rebuilding SHA256SUMS on every run would silently re-bless a tampered file. Troubleshooting: stat: illegal option -c means BSD stat. Teardown: rm -rf evidence exports.

Objective: merge logs with different time formats and a skewed host clock into one UTC timeline. Prerequisites: Python 3.8+; 45 minutes. Scenario (illustrative): laptop ws-114 ran a malicious download; an AWS key stored on it was used from 203.0.113.50. The case notes say ws-114’s clock runs 95 seconds fast; the VPN logs local time at UTC+2.

1. Save the three inputs (edr.csv, cloudtrail.json, vpn.log, in that order) and timeline.py in one directory.
2. Run python3 timeline.py, then python3 timeline.py ws-114=95.
3. Which run is physically possible? What is the earliest attacker event?

Example status: executed 2026-10-17; JSON and Python syntax-checked; IP addresses are documentation ranges.

host_epoch,host,event
1791842055,ws-114,browser wrote build-tools.zip to Downloads
1791842380,ws-114,unsigned process read C:\Users\jdoe\.aws\credentials
1791842820,ws-114,powershell.exe -enc (encoded command)

{"Records": [
  {"eventTime": "2026-10-12T22:01:44Z", "eventName": "CreateAccessKey",
   "userIdentity": {"userName": "ci-deployer"}, "sourceIPAddress": "203.0.113.50"},
  {"eventTime": "2026-10-12T21:59:02Z", "eventName": "GetCallerIdentity",
   "userIdentity": {"userName": "ci-deployer"}, "sourceIPAddress": "203.0.113.50"}
]}

2026-10-13 00:03:10 +0200 login user=j.doe src=203.0.113.50 result=success
2026-10-12 23:40:02 +0200 login user=j.doe src=198.51.100.7 result=success

"""Merge three log sources into one UTC timeline (Lab 2). Python 3.8+."""
import csv
import json
import sys
from datetime import datetime, timedelta, timezone


def load_edr(path, skew):
    rows = []
    with open(path, newline="") as f:
        for r in csv.DictReader(f):
            t = datetime.fromtimestamp(int(r["host_epoch"]), tz=timezone.utc)
            fix = skew.get(r["host"], 0)  # seconds the host clock runs ahead
            rows.append((t - timedelta(seconds=fix), "edr:" + r["host"], r["event"]))
    return rows


def load_cloudtrail(path):
    rows = []
    with open(path) as f:
        for e in json.load(f)["Records"]:
            t = datetime.strptime(e["eventTime"], "%Y-%m-%dT%H:%M:%SZ")
            who = e["userIdentity"].get("userName", "?")
            text = f'{e["eventName"]} by {who} from {e["sourceIPAddress"]}'
            rows.append((t.replace(tzinfo=timezone.utc), "cloudtrail", text))
    return rows


def load_vpn(path):
    rows = []
    with open(path) as f:
        for line in f:
            if not line.strip():
                continue
            date, clock, offset, rest = line.split(" ", 3)
            t = datetime.strptime(f"{date} {clock} {offset}", "%Y-%m-%d %H:%M:%S %z")
            rows.append((t.astimezone(timezone.utc), "vpn", rest.strip()))
    return rows


def main(argv):
    skew = {}
    for arg in argv[1:]:
        host, seconds = arg.split("=")
        skew[host] = int(seconds)
    events = load_edr("edr.csv", skew) + load_cloudtrail("cloudtrail.json")
    events += load_vpn("vpn.log")
    events.sort(key=lambda e: e[0])
    for t, source, text in events:
        print(f"{t:%Y-%m-%dT%H:%M:%SZ}  {source:<12} {text}")
    print(f"earliest event: {events[0][0]:%Y-%m-%dT%H:%M:%SZ} ({events[0][1]})")


if __name__ == "__main__":
    main(sys.argv)

Expected output with ws-114=95:

2026-10-12T21:40:02Z  vpn          login user=j.doe src=198.51.100.7 result=success
2026-10-12T21:52:40Z  edr:ws-114   browser wrote build-tools.zip to Downloads
2026-10-12T21:58:05Z  edr:ws-114   unsigned process read C:\Users\jdoe\.aws\credentials
2026-10-12T21:59:02Z  cloudtrail   GetCallerIdentity by ci-deployer from 203.0.113.50
2026-10-12T22:01:44Z  cloudtrail   CreateAccessKey by ci-deployer from 203.0.113.50
2026-10-12T22:03:10Z  vpn          login user=j.doe src=203.0.113.50 result=success
2026-10-12T22:05:25Z  edr:ws-114   powershell.exe -enc (encoded command)
earliest event: 2026-10-12T21:40:02Z (vpn)

Validation: without the fix, the credential read appears at 21:59:40Z, after the key’s first use at 21:59:02Z, which is impossible; with it, the read comes first. The VPN login dated 13 October locally is 12 October in UTC. The earliest event is the user’s normal login; the earliest attacker event is the download at 21:52:40Z, which sets the dwell-time start and the recovery-point cut-off. CreateAccessKey gave the attacker a second key, which is why S1 deactivates every key. Troubleshooting: a ValueError on time parsing usually means a missing UTC offset; fix the input, do not guess a zone. Teardown: delete the directory.

Objective: turn decision timestamps into draft deadlines and see that each regime starts at a different event. Prerequisites: Python 3.8+; 30 minutes. Scenario (illustrative): a group with an EU bank subsidiary, an Indian operating company and a US listing; counsel has decided which regimes apply. A teaching tool, not legal advice.

Example status: executed 2026-10-17; JSON and Python syntax-checked; rules as in notification duties.

{
  "aware": "2026-10-16T14:20:00Z",
  "dora_classified_major": "2026-10-16T19:05:00Z",
  "sec_materiality_determined": "2026-10-22T16:00:00Z",
  "now": "2026-10-16T21:00:00Z",
  "us_holidays": ["2026-11-11", "2026-11-26"],
  "regimes": ["gdpr", "nis2", "dora", "sec", "certin"]
}

"""Lab 3: draft notification deadlines from decision timestamps (not legal advice).

Which regimes apply, and when each clock started, are decisions for counsel.
Python 3.8+. Usage: python3 clocks.py clocks.json
"""
import calendar
import json
import sys
from datetime import datetime, timedelta, timezone

H = timedelta(hours=1)


def ts(text):
    return datetime.strptime(text, "%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=timezone.utc)


def add_month(t):
    year, month = (t.year + 1, 1) if t.month == 12 else (t.year, t.month + 1)
    day = min(t.day, calendar.monthrange(year, month)[1])
    return t.replace(year=year, month=month, day=day)


def add_business_days(t, days, holidays):
    while days:
        t += timedelta(days=1)
        if t.weekday() < 5 and t.strftime("%Y-%m-%d") not in holidays:
            days -= 1
    return t


def deadlines(c):
    aware, out = ts(c["aware"]), []
    if "gdpr" in c["regimes"]:
        out.append(("GDPR Art. 33: supervisory authority", aware + 72 * H))
    if "nis2" in c["regimes"]:
        out.append(("NIS2 Art. 23: early warning", aware + 24 * H))
        notif = aware + 72 * H
        out.append(("NIS2 Art. 23: incident notification", notif))
        name = "NIS2 Art. 23: final report (if notified at deadline)"
        out.append((name, add_month(notif)))
    if "dora" in c["regimes"] and c.get("dora_classified_major"):
        cls = ts(c["dora_classified_major"])
        first = cls + 4 * H
        if cls <= aware + 24 * H:
            first = min(first, aware + 24 * H)
        out.append(("DORA RTS Art. 5: initial notification", first))
        name = "DORA RTS Art. 5: intermediate (if initial at deadline)"
        out.append((name, first + 72 * H))
    if "sec" in c["regimes"] and c.get("sec_materiality_determined"):
        det = ts(c["sec_materiality_determined"])
        due = add_business_days(det, 4, set(c.get("us_holidays", [])))
        out.append(("SEC Form 8-K Item 1.05 (date only)", due))
    if "certin" in c["regimes"]:
        out.append(("CERT-In direction (ii): report", aware + 6 * H))
    return sorted(out, key=lambda x: x[1])


def main(path):
    with open(path) as f:
        c = json.load(f)
    now = ts(c["now"])
    for name, due in deadlines(c):
        left = (due - now).total_seconds() / 3600
        flag = "OVERDUE" if left < 0 else f"{left:7.1f} h left"
        print(f"{due:%Y-%m-%d %H:%M}Z  {flag:>14}  {name}")


if __name__ == "__main__":
    main(sys.argv[1])

Expected output of python3 clocks.py clocks.json:

2026-10-16 20:20Z         OVERDUE  CERT-In direction (ii): report
2026-10-16 23:05Z      2.1 h left  DORA RTS Art. 5: initial notification
2026-10-17 14:20Z     17.3 h left  NIS2 Art. 23: early warning
2026-10-19 14:20Z     65.3 h left  GDPR Art. 33: supervisory authority
2026-10-19 14:20Z     65.3 h left  NIS2 Art. 23: incident notification
2026-10-19 23:05Z     74.1 h left  DORA RTS Art. 5: intermediate (if initial at deadline)
2026-10-28 16:00Z    283.0 h left  SEC Form 8-K Item 1.05 (date only)
2026-11-19 14:20Z    809.3 h left  NIS2 Art. 23: final report (if notified at deadline)

Validation: DORA: classification at 19:05 plus 4 hours is 23:05, earlier than awareness plus 24 hours. SEC: four business days after Thursday 22 October 2026 is Wednesday 28 October. The lesson: the 6-hour CERT-In clock expired while the team was still scoping. Simplifications: one awareness time for all regimes (counsel may judge each differently); NIS2 applies through national law; filing cut-off times are ignored. The SEC expects materiality to be determined “without unreasonable delay following discovery”;^[40] the six days here are a scenario input, not a benchmark. Troubleshooting: KeyError: aware, now or regimes is missing from clocks.json; ValueError: a timestamp is not in YYYY-MM-DDTHH:MM:SSZ form; every line OVERDUE: check now. Teardown: delete the files.

Objective: test decisions, authority and handoffs in a discussion that deploys no equipment.^[41] CISA offers over 100 scenario packages, physical and cyber, including ransomware.^[42] Prerequisites: 90 minutes; the IR lead, an incident commander, counsel, communications, an executive, the owners of one critical service and of backups; a facilitator who does not play.

Expected output: a decision log with owners and times, a list of gaps, and three to five dated actions. Validation: every inject produced a named decision owner. Troubleshooting: when the room drifts into technical detail or “it depends”, the facilitator asks who decides, on which facts, by when. Teardown: file the report with the plan owner and treat it as restricted: it lists real gaps.

Scenarios in the table are illustrative; the case below it is documented.

A documented lesson on privilege (United States). After Capital One’s 2019 breach, outside counsel engaged Mandiant, which already had a 2015 master agreement and a January 2019 statement of work with the bank for incident response. In June 2020 a federal district court upheld an order to produce Mandiant’s report. The work-product test asks whether a document “would not have been prepared in substantially similar form but for the prospect of that litigation”; the court held that Capital One “failed to establish … that the report Mandiant would have created for Capital One pursuant to its pre-data breach SOW would not have been substantially the same in substance or scope as the report Mandiant prepared for Debevoise”, and treated the report’s distribution to about 50 employees, the board, four regulators and the accountant as probative.^[43] How to structure an investigation is for counsel and LegalOps; the operational lesson is to plan reporting lines beforehand.

NIST’s 2012 guide warned that incident counts measure workload, not quality, adding in a footnote that such counts “are generally not of value in a comparison of multiple organizations because each organization is likely to have defined key terms differently”; it suggested separate counts per incident category instead.^[11] Measure a few intervals and outcomes per incident, report medians and ranges, review quarterly. MTTA and MTTR are defined on IncidentOps; these are specific to adversarial incidents.

Leading indicators: exercise actions closed on time, tested playbooks, log coverage. Lagging: dwell time, re-entry, timeliness.

Context, not a benchmark: Mandiant’s 2025 investigations (cases serious enough to hire Mandiant) show a global median dwell time of 14 days, and 122 days for espionage and North Korean IT-worker cases.^[13]

The clocks below commonly apply as of October 2026. This is not legal advice and not complete: US state laws (to which CISA’s guide points^[9]), sector regulators and contracts add more. Whether a duty applies is a legal decision; responders supply timestamped facts. The personal-data breach workflow belongs to PrivacyOps.

A 2025 petition asks the SEC to rescind Item 1.05 (File No. 4-856),^[52] and trade associations asked again in April 2026, answering the SEC Chairman’s January call for comments on Regulation S-K (File CLL-15);^[53][54] no proposed or adopted change was found on 2026-10-17. NIST’s summary: notification law “is an evolving topic”.^[1] Re-check the table quarterly and after any SEC, CIRCIA or EU rule change.

Ransom payments. OFAC: “The U.S. government strongly discourages all private companies and citizens from paying ransom or extortion demands”; sanctions penalties apply on “strict liability”; an early, complete report to law enforcement or CISA is “a significant mitigating factor”.^[55] Payment is an executive decision on legal advice; responders keep recovering as if none will happen.

Records and privacy. Investigation records are sensitive; NIST asks for protected confidentiality and integrity and limited access.^[1] RFC 3227 warns against collecting from areas you would not normally access without “sufficient indication that there is a real incident”;^[10] monitoring an employee may need HR and legal approval under local law.

• People. Response is surge work: ask how many parallel incidents you can sustain for two weeks.
• Retainers and insurance. Agree contacts, scope and authority beforehand; check what the cyber insurance policy requires (CISA lists the insurer among the parties to inform).^[9]
• Evidence and logs. NIST asks you to weigh the chance of prosecution against the cost of keeping evidence readable;^[1] keep logs longer than expected dwell (CERT-In requires 180 days^[50]); SecDataOps owns the cost trade-off.

Tabletop exercises test decisions; functional exercises test whether people can perform procedures in a simulated environment.^[41] This page suggests one of each per year, with suppliers where possible, as NIST recommends; test the out-of-band bridge, break-glass accounts, evidence store and retainer hotline quarterly; track actions to closure; and use the self-assessments, third-party assessments and audits NIST lists.^[1]

This is the ResponseOps side of the recovery steps on BackupOps, following CISA’s #StopRansomware checklist.^[9] Because services are down, the incident commander from IncidentOps coordinates the whole response while the IR lead runs the security workstream below and approves recovery points (Atlas proposal).

flowchart TB
  A["Declare SEV-1 out of band; isolate segments"]
  A --> B["Memory and images from a sample; freeze backup deletions"]
  B --> E["Scope: earliest attacker activity, footholds"]
  E --> F{"New footholds still appearing?"}
  F -- "Yes" --> E
  F -- "No" --> G["Eviction window: identity rebuild, persistence removal"]
  B -.->|"in parallel, once contained"| H["Clean room: hosts from trusted images"]
  H --> I{"Data point within retention that scans clean?"}
  I -- "Yes" --> K["Restore the newest clean point; reconcile later data"]
  I -- "No" --> L["Rebuild data from other sources"]
  G --> J["After eviction: promote by priority; watch for re-entry"]
  K --> J
  L --> J
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef decision fill:#fdf3e3,stroke:#c9800f,color:#122029
  classDef risk fill:#fbeceb,stroke:#b4332b,color:#122029
  class A,L risk
  class B,E,G,H,K,J core
  class F,I decision

Clean-room work need not wait for eviction: CISA notes that eradication and recovery “can be executed simultaneously”.^[12] When retention is shorter than dwell (Mandiant’s espionage median is 122 days^[13]), no point predates the attacker: rebuild hosts anyway and take data from the newest clean point or other sources, as on BackupOps. The costliest mistakes: restoring hosts from backup before scoping (the dropper comes back) and resetting krbtgt once.

• “Wipe and reimage, done.” It removes evidence and one foothold, not the actor. Instead: scope, then evict everywhere at once.
• “Contain everything immediately.” Right when harm is in progress; otherwise it can tip off the attacker or trigger destruction.^[9][11] Instead: use the containment decision and time-box delays.
• “We have backups, so ransomware is a restore job.” Stolen data remains a problem after the restore.^[9]
• “Label it privileged.” Routing through counsel did not protect Capital One’s report.^[43] Instead: counsel designs the structure before an incident.

Build a deliberate capability (named IR lead, plan with authority, playbooks, evidence handling, clocks map) if you process regulated data at scale, fall under a notification regime above, run a SOC that escalates real intrusions, or depend on a directory or cloud estate whose compromise would stop the business.

Do not over-apply it:

• To ordinary outages. Evidence rules slow recovery; use IncidentOps until a security cause is suspected.
• To every malware alert. Most malware incidents do not merit evidence acquisition;^[11] Evidence says when custody is formal.
• As an in-house team in a small organisation. Twenty people cannot staff 24×7 forensics: write a one-page plan, buy response, and keep decisions, notifications and evidence custody in-house.

Exit criteria for an incident: scope stable, eviction done, no attacker activity in the watch period, restores validated, notices filed, actions assigned. The eviction plan sets the watch period per incident (the playbook above uses 72 hours); the re-entry KPI counts attacker activity within 90 days of eviction, so the two windows differ by design.

NIST describes handlers on staff, on contract or available when needed.^[1] The weighted comparison is an illustrative profile: a 300-person EU company under NIS2, one SOC analyst in business hours, a Windows domain and one cloud. Scores: 1 (poor) to 5.

B wins narrowly. Sensitivity: raise night-time response to 35 and cut estate knowledge to 10, and C scores 375, B 365, A 305: the weights carry the decision, so argue about them openly; many organisations combine B and C.

A five-level model proposed by this Atlas; a level is reached when its evidence exists.

First hour

• Declared; severity set; awareness time and reasoning recorded
• Codename; restricted case; team called by phone, not email
• Legal and sponsor informed; incident commander paged if services are affected
• Containment decision logged; no reboot or reimage without approval
• Volatile evidence collection started; BackupOps asked to freeze deletions (ransomware)

Evidence

• Most volatile first, trusted tools; each item hashed with a UTC custody row
• Clock offset of each source recorded; cloud and SaaS logs exported before they expire
• Analysis on copies; originals in write-once storage

Eviction and recovery

• Scope stable for a full hunt cycle; every foothold listed with an owner
• Identity steps sequenced (sessions, krbtgt, service credentials, app consents)
• Hosts rebuilt from trusted images; data from the newest point that scans clean, reconciled; root cause fixed^[1]

After-action

• Timeline, decisions and reasons written up within 30 days; actions with owners and dates; notices filed with the record

One-page incident response plan (after NIST;^[1] starred lines are this page’s)

INCIDENT RESPONSE PLAN   v<n>   Owner: <IR lead>   Approved: <executive sponsor>, <date>
1. Purpose and objectives; scope (whom, what, when); management commitment, resources
2. Definitions: event, incident, investigation; declaration criteria (severity matrix)
3. Roles and authority: IR lead, deputy; who may confiscate, disconnect or shut down
4. Priorities: severity levels; who starts recovery; which services return first
5*. Contacts, out of band: bridge, phone tree, break-glass holders, retainer hotline,
    insurer, counsel, who calls law enforcement
6*. Notification owners: per regime, who decides and who files (clocks map, Lab 3)
7*. Evidence: store, custody form, log retention per source
8*. Links: playbooks, IncidentOps handoff, BackupOps freeze, continuity plan
9. Measures and exercises: KPIs; exercise cadence <e.g. tabletop + functional yearly>
10. Review: <cadence>, and whenever an incident shows a needed improvement

Declaration and clocks record

INCIDENT: IR-2026-014   CODENAME: sapphire-river   SEVERITY: SEV-1
Declared (UTC): 2026-10-13T09:55Z   by: <IR lead>   criteria met: <row of matrix>
Awareness decisions (each with time, decider, reasoning):
  GDPR personal data compromised?   <yes/no/unknown>  <UTC>  <name>  <why>
  NIS2 significant incident?        <yes/no/unknown>  <UTC>  <name>  <why>
  Other duties (contract, insurer, sector):  <list>
Authorities used: <who approved which containment action, when>
Out-of-band bridge: <number>   Restricted channel: <name>

Decision log entry

UTC time | decision | options considered | chosen because | owner | review at
2026-10-13T10:20Z | isolate VLAN 40 now | wait for memory capture / isolate now
  | encryption spreading to file shares | <exec sponsor> | 11:00Z

Chain-of-custody form (one per item)

Item ID: IR-2026-014-007    Description: memory image, host db-02 (64 GiB)
Source: hostname, serial, IP, cloud instance ID
Collected (UTC): <time>   by: <name, role, phone>   tool and version: <...>
SHA-256 at collection: <hash>
Transfers: UTC time | from | to | purpose | hash verified (Y/N) | signatures
Storage location(s): <write-once bucket / locker>   Retention until: <date>

Notification decision record

Regime: <e.g. GDPR Art. 33>   Decided by: <counsel>   Decision time (UTC): <...>
Clock start used: <event and UTC time>   Deadline: <UTC>
Facts relied on: <scope statement version, data categories, approximate counts>
Decision: notify / do not notify / notify in phases   Reasoning: <...>
Filed: <UTC, reference>   Follow-ups due: <UTC>

After-action report outline

1. Summary (what happened, impact, duration)    5. What went well / badly (facts)
2. Timeline in UTC with sources                6. Root causes (technical and process)
3. Scope: assets, identities, data             7. Actions: owner, due date, measure
4. Decisions and their reasons                 8. Metrics: dwell, contain, scope growth

Is “ResponseOps” just another name for incident response? In this Atlas, yes. The label is rare and used for unrelated things, so write “incident response” in contracts and policies.

Should we shut down infected machines? Isolate rather than power off where you can; CISA advises powering down only if you cannot disconnect, because it loses memory evidence.^[9] When destruction is in progress, stopping it wins; see the judgement call.

Can our MDR provider or retainer do all of this? Much of the technical work, within the authority their contracts define.^[1] Decisions, notifications and priorities stay yours.

How do we know the attacker is gone? Never with certainty. Meet the exit criteria, above all no activity from the attacker’s infrastructure or techniques during the watch period.

Should we pay the ransom? Not a responder’s call. OFAC “strongly discourages” paying and treats an early report to law enforcement as “a significant mitigating factor”;^[55] CISA suggests asking federal law enforcement about decryptors first.^[9] The executive sponsor decides on counsel’s advice (see ransom payments); the team keeps recovering regardless.

What will law enforcement need from us? CISA’s guide asks victims to report to CISA, the FBI (or IC3) or the Secret Service, and describes federal threat response as including “collecting evidence and gathering intelligence”.^[9] Expect requests for the ransom note, the attacker’s contact details, indicators, preserved images and logs, and your UTC timeline; go through counsel and log each hand-over.

• Speed. With access changing hands in seconds,^[13] expect more pre-approved automated containment, and debate over its limits.
• Recovery denial. Attacks on backups, identity and hypervisors pull response and recovery together.^[13]
• Eviction planning from techniques (CISA’s 2025 tool^[15]): promising; field results are not yet well documented.

Situation (illustrative). At 01:30 a Linux database server holding customer records runs an unknown process with an outbound connection to an unfamiliar address, and traffic is rising. Assume your tested memory capture takes about 20 minutes on this host.

• A. Power off now. PagerDuty’s public checklist says to stop an attack “as quickly as you can, via any means necessary”, while asking responders not to delete or terminate instances because forensics will be needed.^[17]
• B. Capture memory, then isolate. RFC 3227 says not to shut down before collection is complete; CISA notes that powering down loses evidence in volatile memory.^[10][9]
• C. Isolate now at a layer that cuts existing connections, and capture memory with the host running. For example EDR host isolation, the switch port, or on AWS a network ACL deny for the attacker’s addresses (a security group change usually leaves a tracked connection running; only flows AWS does not track drop at once).^[23][25] Losing the network may trigger a dead-man’s switch.^[10][11]

Reasoning. A is attractive: decisive and certain. It can be wrong because memory may hold the only evidence of what was taken and which credentials were exposed; without it, notices widen and the eviction may miss credentials. B keeps the facts but gives the attacker 20 more minutes. C usually wins: the outflow stops almost at once and memory survives, at a small risk of a destructive trigger.

Recommendation. C, with a pre-agreed switch to A at the first sign of destruction (mass file changes, log wiping). Uncertainty: if the host is one of many already-imaged replicas, A costs little; if regulated data is leaving fast and isolation is not instant, A may be right. Log the decision and its reason either way.

After this page you should be able to explain what an adversary changes; choose when and how to contain; preserve evidence defensibly; plan eviction and clean recovery; map notification clocks with counsel; and evaluate build, retain or buy.

1. An administrator proposes emailing all staff: “Server FS-03 is compromised; do not use it.” What is wrong?

2. You replaced an EC2 instance’s security groups with an empty one, but its command-and-control connection persists. Why, and what next?

3. A user was disabled at 10:00, but mailbox access continues at 10:40. Explain and fix.

4. A ransom note claiming customer data arrives Friday 18:00 UTC; on Saturday 11:00 UTC your team confirms data left. When did the GDPR clock most likely start, and what is the latest deadline?

5. Why reset krbtgt twice, ten hours apart?

6. Your median scope growth is 2.5. What does it say, and what would you change?

ResponseOps is a borrowed label for an old discipline. Underneath it is the part of security work where an opponent turns operations instincts into liabilities: rebooting destroys facts, fast fixes warn the attacker, partial cleanup invites them back, and the law’s clock starts before you know what happened.

What works is unglamorous: decide authority before you need it, talk out of band, collect before you change, scope until the picture stops moving, evict in one move, recover from points you can prove are clean, and manage every deadline as a fact. Teams that do this are not faster in the first hour; they finish once.

“Checked” is the day a source was last opened; other dates are the source’s own. Claim-level support and unfetchable sources: research/responseops-ledger.md.

Changelog.

• 2026-10-16, r0: first draft (research, ledger, Labs 1–3 executed, six diagrams); cut from about 12,100 words to the band.
• 2026-10-17, r1: after the first review (now reviews/responseops-r1-superseded-20261017T0434.md): AWS isolation and key containment, recovery rule, Lab 1 integrity (re-executed), CAE and non-token persistence, ISO/IEC 27035-3, SEC updates; 13 sources added.
• 2026-10-17, r1 second pass: after the replacement review (reviews/responseops-r1.md; answers in reviews/responseops-r1-response.md): Capital One holding and SP 800-61 Rev. 2 footnote quoted, Figure 2 Improvement edges, untracked flows, DORA and SEC precision, terms defined, Graph scope note, lab troubleshooting, watch windows, two FAQ entries; repetition cut to stay in band; Labs 1–3 re-run.
• 2026-10-17, post-score polish: footnote precision (SANS, Timesketch, FIRST), plan template, S2 commands, re-check trigger.
• 2026-10-17, orchestrator: revoke cutoff moved after key deactivation, ~30 s ahead as in AWS’s console.