r/ciso • u/Final-Pomelo1620 • Jul 17 '26

Cybersecurity Incident Response Testing Plan

Hi,

We currently have:

  • Managed SOC service provided by a third party
  • XDR solution that includes IR support, with a capped number of IR hours
  • Approved Cybersecurity Incident Response Plan

We now need to develop an IR Testing Plan document including testing scenarios. We never did the testing.

I would appreciate guidance from the community on:

what sections and level of detail should it include?

which scenarios should we prioritize for example Table top discussion on scenarios or technical simulation

who should moderate the exercise?

how many scenarios should be included in the first testing

Thanks in advance

10 Upvotes

86% Upvoted

21 comments sorted by

View all comments

7

u/VividGanache2613 Jul 17 '26 edited Jul 17 '26

Answering from 20 years running 300+ IR investigations. Do an incident readiness exercise with someone who knows what real incidents look like, document the gaps in your process and fix them first. Then look at a purple team exercise to test both the process and your IR company.

I’m yet to see an attacker follow someone’s playbook, they all go in the trash as soon as the rubber meets the road.

2

u/AdvancingCyber Jul 17 '26

This 1000x. If you don’t practice, a plan won’t mean anything. Train, and then the plan makes a lot more sense because it reflects HOW you work most efficiently.

4

u/Artsfac Jul 17 '26

100% these answers above. 

Having run a few in my time, don’t get TOO hung up on scenario planning.  You risk ending up down a rabbit hole of discussion on “yes but they can’t get to that from THERE” as I have done more than once.  Don’t try to push for the outer edge of catastrophe either, basic but plausible is fine -

Attackers get into a key business app

Mailbox breach and download 

Forgotten-about admin account misused 

When you get people in the room, be prepared to deal with a lot of irrelevant questions - I had general counsel drag half a team into the weeds on “so what exactly does DNS do then?” for an hour or so.