CYBER-06-003-P · Primer — Preparation: IR Readiness

The idea in one sentence

Preparation is the incident-response phase you finish before any incident — standing up the plan, the named people, the tooling, and the communications so that when an attack lands you execute instead of improvise.

Why it exists

You cannot recruit firefighters, buy the trucks, and map the hydrants while the building is burning. The fire department has to exist before the fire. Think of a kitchen: you pre‑heat the oven, gather the pans, and measure the ingredients before the timer starts; if you wait until the dough is already rising you’ll never get a cake out of the oven in time. NIST SP 800-61 puts Preparation first in the incident‑response lifecycle for exactly this reason: every later phase spends the capability that preparation built. Detection can only find what your logging was configured to keep; containment can only move as fast as the access you staged in advance; recovery can only restore backups you actually tested. Incidents are high‑stress and time‑boxed — the decisions you make cold, in daylight, are far better than the ones you make at 2 am under pressure with an adversary live in your network.

How it works

Preparation is not a mindset; it is four concrete deliverables you can point at.

The plan and playbooks. An incident‑response policy that grants authority, an IR plan approved by leadership, and per‑scenario playbooks — ransomware, business email compromise, data exfiltration — each a rehearsed sequence rather than a blank page. Worked example: In Q1 2024 the CSIRT drafted a ransomware playbook that defines three steps: (1) isolate affected hosts by disabling their network adapters via a PowerShell script (takes ~30 seconds per host), (2) trigger a snapshot on the affected volume using the backup appliance API (average 2 minutes), and (3) launch a forensic collection job that copies the last 48 hours of event logs to a secure share (≈5 minutes per host). When a real ransomware event hit on 2024‑06‑12, the team ran the script on 12 hosts, completed isolation in 6 minutes, captured snapshots in 2 minutes, and had all logs ready for analysis within 7 minutes, shaving hours off the response timeline.

Named roles. A CSIRT (Computer Security Incident Response Team) with a named incident commander, an on‑call rotation, and a contact tree that actually reaches legal, communications/PR, executives, and law enforcement.

Tooling and telemetry. Centralized logging with retention long enough to investigate, a SIEM to search it, EDR/XDR on every endpoint, and a forensic jump kit with pre‑staged access so responders aren't filing access tickets mid‑incident.

Communication. Out‑of‑band channels — because if email and chat are compromised you still have to coordinate — plus explicit criteria for who declares an incident and when to escalate. NIST also folds prevention (hardening to reduce the incident count) into this phase.

See it — the NIST SP 800-61 IR lifecycle loop

flowchart LR
  P["Preparation<br/>plan · roles · tools"] --> D["Detection<br/>and Analysis"]
  D --> C["Containment<br/>Eradication<br/>Recovery"]
  C --> A["Post-Incident<br/>lessons learned"]
  A --> P
  D -.-> P

The one gotcha

Preparation is invisible when it works, so it is the first thing cut. The gap never shows in a quiet quarter — it shows during the incident, when it is far too late to fix. The gotcha is that organizations treat preparation as a “nice‑to‑have” checklist and then assume the checklist will magically fill the gaps. In reality, without regular rehearsals the documented steps become stale, contacts become outdated, and tooling drifts out of sync. Picture 2 am on a Saturday: ransomware is spreading across the file servers and the clock is running. The prepared team opens the ransomware playbook, the incident commander takes control, and staged containment steps execute. The unprepared team discovers that no one knows who is allowed to declare an incident, the backups were never test‑restored, and the phone tree is a year out of date — so they improvise, and they lose hours they will never get back. The phase that decides the outcome is the one you finish before anything happens.

The one-line takeaway

You can't build the fire department during the fire.

Where you'll meet it

Preparation is the work behind every SIEM and EDR rollout you'll touch — OpenSearch, Wazuh, or Graylog for the logs; osquery or Velociraptor on the endpoints; TheHive and Cortex for case management. It's the reason teams write detections as code in Sigma, map their coverage on the MITRE ATT&CK Navigator, and pull down CISA's Federal Incident Response Playbooks and advisories before they're needed. Frameworks name it directly: NIST SP 800-61 is the blueprint, SANS PICERL its sibling, and the tabletop exercise is how you prove the plan survives contact with reality.

Named concepts: incident response preparation, IR lifecycle, CSIRT, incident response plan