Microsoft® Windows® Security Resource Kit, Second Edition

Defining Incident Response Policy

Once the members of the incident response team have been identified, they should convene to build an incident response process and a supporting policy. Some of the related policies might already be in place in your organization, but the team will need to review how each of these policies relates to incident response and recommend changes that support incident response activities. The team must also formalize the approach to take should responding to an incident become necessary.

Categorizing Types of Incidents

Up to this point, we have been using the term incident in a generic manner. An incident is an occurrence that creates some level of crisis and requires action to reduce or eliminate the risk caused. Possible ...