After the incident: make it harder next time
Draft: pending legal review.
Finish the incident first: contain it, preserve evidence, notify who you must, and recover. Then use what happened to improve. The NIST Cybersecurity Framework 2.0 is a free, widely used way to organize that work, and it comes from the same family of NIST guidance as the incident response approach behind this tool.
The six functions
- Govern. Who is responsible, what the rules are, and how you manage cyber risk.
- Identify. Knowing what you have and what could go wrong.
- Protect. The safeguards that stop or limit an attack.
- Detect. Noticing something is wrong quickly.
- Respond. What you do when something happens.
- Recover. Getting back to normal, safely.
Where each kind of incident points
General practice, at the framework's category level. It is a starting point, not an assessment of your organization.
Ransomware / systems locked or encrypted
- Data Security (PR.DS): Keep backups that an attacker can't reach, and test restoring from them, so you aren't forced to consider paying.
- Identity Management, Authentication, and Access Control (PR.AA): Require multi-factor authentication and limit powerful admin accounts.
- Technology Infrastructure Resilience (PR.IR): Separate systems so one compromise can't reach everything.
- Continuous Monitoring (DE.CM): Watch for intruders so you find them before they lock your systems.
- Incident Recovery Plan Execution (RC.RP): Write down and practice the order you'd restore things in.
Email or account compromise (stolen password, phishing, takeover)
- Identity Management, Authentication, and Access Control (PR.AA): Turn on multi-factor authentication everywhere, and review who has access to what.
- Awareness and Training (PR.AT): Train people to spot phishing and to report it fast, with no blame.
- Continuous Monitoring (DE.CM): Alert on unusual sign-ins, forwarding rules, and new app permissions.
- Adverse Event Analysis (DE.AE): Decide who looks at alerts, and how quickly.
Data exposed or stolen (misconfiguration, leak, bulk download)
- Platform Security (PR.PS): Check configurations and control changes so storage and databases aren't left open.
- Data Security (PR.DS): Protect sensitive data where it's stored and where it travels.
- Asset Management (ID.AM): Keep an inventory of where your data and systems are, so nothing is forgotten.
- Risk Assessment (ID.RA): Review risks regularly, including what you put on the internet.
Lost or stolen laptop, phone, or drive
- Data Security (PR.DS): Encrypt laptops and phones so a lost device doesn't expose what's on it.
- Platform Security (PR.PS): Manage devices so you can lock or wipe them remotely.
- Asset Management (ID.AM): Know which devices you have and who holds them.
A vendor or partner told us they were breached
- Cybersecurity Supply Chain Risk Management (GV.SC): Know which vendors hold your data, what they must tell you after an incident, and how fast.
- Risk Assessment (ID.RA): Include vendors in your risk reviews.
- Identity Management, Authentication, and Access Control (PR.AA): Limit and review the access you give vendors.
Someone inside the organization (employee or contractor)
- Identity Management, Authentication, and Access Control (PR.AA): Give people only the access they need, and remove it promptly when roles change or they leave.
- Continuous Monitoring (DE.CM): Monitor important systems for unusual access and bulk copying, within your policies and the law.
- Roles, Responsibilities, and Authorities (GV.RR): Define who handles HR, legal, and security together, before you need to.
- Awareness and Training (PR.AT): Make expectations and reporting channels clear.
Fraudulent payment / wire / invoice scam
- Policy (GV.PO): Set a rule that payment or bank-detail changes are confirmed by phone with a known number.
- Awareness and Training (PR.AT): Train the people who handle payments to spot fake requests.
- Identity Management, Authentication, and Access Control (PR.AA): Protect email accounts with multi-factor authentication.
- Adverse Event Analysis (DE.AE): Flag lookalike domains and unusual payment requests.
Already working through an incident? Your plan has an After the incident section that uses your own answers and a six-question self-check.Start a plan.
Turn this into a security roadmap
upCISO is a new compliance-readiness service from InventiveHQ, the publisher of this guide. It is still in development. It helps teams turn security and compliance requirements into a plan: capture systems, data, and obligations, map gaps, link policies and evidence, and track action items with owners and due dates, with crosswalks to NIST CSF and other frameworks.
upCISO supports readiness and gap analysis. It is not a certification or an independent assessment, and its framework crosswalks don't determine compliance. You don't need upCISO to use this guide or to improve your security.
Framework names are from NIST CSF 2.0. This site is independent and not endorsed by NIST. General information, not legal or compliance advice: see the disclaimer.