Templates / Attestation Flow

Incident response runbook template

For everyone who may spot a security incident. The runbook walks through report, triage, contain, notify and learn, with a quiz on the first step, seven days to complete and re-attestation every 180 days.

• App: Attestation Flow for Confluence
• Category: Security
• Edition: Picking the pack works in every edition; the paid settings and the starter text need a paid licence
• Re-acknowledge: every 180 days

Note shown to readers:

By acknowledging, you confirm you know how to report an incident and what your role is during one.

Template. This template is a starting point, not legal advice. Adapt it to your organisation, your contracts and the law that applies to you, and have it reviewed by a qualified professional before you rely on it.

When to use this runbook

Use it for any event that may compromise the confidentiality, integrity or availability of [Company] systems or data: malware, lost devices, suspicious logins, data sent to the wrong person, outages caused by an attack.

1. Report

• Report immediately through [incident channel or phone number].
• Say what you saw, when, and which systems or data may be affected.
• Do not switch off affected machines unless told to; preserve evidence.

2. Triage and lead

The on call [role] assigns an incident lead, rates severity ([levels]) and opens an incident record in [tool].

3. Contain, eradicate, recover

• Contain: isolate affected accounts and systems.
• Eradicate: remove the cause, rotate credentials, patch.
• Recover: restore from known good backups and monitor closely.

4. Notify

The incident lead, with legal and the privacy contact, decides on notifications to customers, regulators (for personal data, possibly within 72 hours) and insurers.

5. Learn

Hold a blameless review within [days]. Record root cause, actions and owners, and update this runbook.

Includes 2 quiz questions; the answers are not published here. They are shown only in the app's requirement editor, to the person setting up the requirement, who can change them before saving.

1. What is the first step when you detect a possible incident?
   • Delete the evidence
   • Report it through [incident channel] and preserve evidence
   • Post about it in a public channel
2. Who decides whether customers or authorities must be notified?
   • Whoever finds the incident
   • The incident lead with legal and privacy contacts
   • Nobody

Edit a Confluence page, insert the Attestation Flow macro, open the requirement editor and pick the pack under Start from a policy pack. It fills the note and the due date; with a paid licence it also fills the re-acknowledgement window, the minimum reading time and the quiz, and can add the starter text to the page. Required readers are never preset: you choose them.

• Attestation Flow for Confluence documentation
• Confluence policy templates: all 16 templates