| name | incident-response-playbook |
| title | Incident Response Plan and Playbook |
| description | Drafts incident response plans and scenario playbooks for U.S. legal organizations, aligning NIST SP 800-61 Rev. 2 phases with ABA Model Rules 1.1/1.4/1.6 and privilege preservation. Use when creating or updating an incident response plan, breach response policy, ransomware playbook, or regulatory notification checklist. Trigger keywords: incident response, playbook, data breach, ransomware, cybersecurity policy, NIST 800-61. |
| author | CaseMark |
| author_url | https://github.com/CaseMark/skills/tree/main/skills/legal/incident-response-playbook |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | cybersecurity |
| language | en |
Incident Response Plan and Playbook
Produces defensible, operational incident response plans and scenario playbooks for legal organizations. Aligns NIST SP 800-61 Rev. 2 with ABA ethics obligations and client confidentiality requirements.
Prerequisites
Gather before drafting:
- Firm profile — practice areas, jurisdictions, client types, offices, critical systems
- Current policies — security, acceptable use, retention, BCP/DR, vendor management
- Data map — systems holding client confidential/privileged data, backups, cloud providers
- Regulatory scope — applicable breach laws, ethics rules, sector regulations (HIPAA, GLBA, CMMC)
- Contacts — internal response team and external vendors with after-hours channels
Quick Start
- Confirm scope and standards (NIST 800-61, ABA Rules 1.1/1.4/1.6, state bar guidance)
- Build plan: governance, taxonomy, detection, phased response, communications, training
- Add scenario playbooks (ransomware, email compromise, unauthorized access, inadvertent disclosure)
- Add appendices: contacts, templates, logs, escalation matrix, regulatory authority map
- Quality-check privilege posture, notification timeframes, role coverage, and version control
Core Workflow
1. Plan Header and Governance
Header block: Title, version, effective date, approvers, distribution, storage location, review dates.
Governance roles — each needs primary duties, decision authority, and named backups:
- Incident Response Coordinator (activate, triage, oversee)
- Legal/Ethics Counsel (privilege, ethics, notifications, regulators)
- IT/Security Lead (forensics, containment, eradication)
- Managing Partner/ED (resourcing, client impact, business decisions)
- Comms Lead (internal/external messaging)
- Practice Leaders (client context, matter impact — advisory)
External engagement checklist:
