Address these eight concerns in your incident response policy

Overview Every organization should include an incident response policy as part of its overall business continuity plan. Here are the most important elements to focus on when you build your IRP.

You may not think you need an incident response policy (IRP). After all, you've locked down your organization's network, and you feel reasonably confident that it's well protected. But even the most secure networks need an IRP. If your organization has no established, coherent plan of action, it can easily make the wrong decisions both during and after a security incident. An IRP offers a cool-headed method for dealing with a hot issue.

Every network is unique, and the type of business your organization conducts on the Internet will influence the level of your response to a security incident. But although the specifics of an IRP will vary, you'll want to cover certain standard issues. Security expert Mike Mullins offers a list of key areas to focus on, including:

• Defining partner agreements
• Developing an incident team
• Designing an internal communications plan

These recommendations, along with information available from sites such as the SANS InfoSec Reading Room, will make it easier to hammer out an IRP that prepares your organization to deal effectively with any incidents that threaten your network.

Join the discussion of this download.