Federal Government Cybersecurity Incident & Vulnerability Response Playbooks.

CISA published the Cybersecurity Incident and Vulnerability Response Playbooks that provide federal civilian agencies with operational procedures for planning and conducting cybersecurity incident and vulnerability response activities.

The Incident Response Playbook applies to incidents that involve confirmed malicious cyber activity and for which a major incident has been declared or not yet been reasonably ruled out. Some examples include incidents involving lateral movement, credential access, exfiltration of data; network intrusions involving more than one user or system; or compromised administrator accounts. The playbook includes a checklist for incident response and another for incident response preparation, and both can be adapted for use by organizations outside the federal government.

The Vulnerability Response Playbook applies to any vulnerability that is observed to be used by adversaries to gain unauthorized entry (i.e., known exploited vulnerability) into computing resources. It builds on CISA’s Binding Operational Directive 22-01 by standardizing the high-level process that agencies should follow when responding to these vulnerabilities that pose significant risk across the federal government. This playbook includes a checklist, which can easily be adapted by non-federal organizations, to track appropriate vulnerability response activities in four phases to completion.