incident-response-plan

name	incident-response-plan
title	Incident Response Plan and Playbook
description	Drafts incident response plans and playbooks for legal organizations, adapting NIST SP 800-61 to law firm contexts including privilege preservation, ethics obligations, and state breach notification compliance. Use when creating IR plans, cybersecurity playbooks, breach response policies, or data incident procedures for law firms or legal departments.
author	CaseMark
author_url	https://github.com/CaseMark/skills/tree/main/skills/legal/incident-response-plan
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	us
practice	cybersecurity
language	en

Incident Response Plan and Playbook

Drafts legally defensible IR plans for law firms and legal departments covering cybersecurity incidents, data breaches, privilege preservation, and professional responsibility compliance.

Prerequisites

Gather before drafting:

1. Organization profile — firm structure, practice areas, office locations, operating jurisdictions
2. Existing policies — infosec policies, business continuity plans, professional responsibility guidelines
3. Regulatory landscape — state breach notification statutes, sector overlays (HIPAA, GLBA, CMMC)
4. Technology environment — case management systems, DMS, email, backup infrastructure
5. Insurance coverage — cyber insurance policy, carrier contact, claim procedures

Quick Start

1. Map jurisdictions and applicable breach statutes
2. Classify incident types by severity tier
3. Define governance roles and escalation chains
4. Draft phased response procedures (NIST 800-61 adapted)
5. Build scenario-specific playbooks
6. Set communication protocols and notification templates
7. Establish training/testing cadence

Output Sections

1. Jurisdictional Analysis

Map per operating jurisdiction:

• Breach notification statutes — triggers, timeframes (typically 30–90 days), AG notification
• Professional conduct rules — ABA Model Rules 1.1 (tech competence), 1.4 (communication), 1.6 (confidentiality)
• Sector overlays — HIPAA, GLBA, CMMC, SEC as applicable
• Ethics opinions — relevant state bar opinions on cybersecurity duties

2. Incident Taxonomy

Four severity tiers:

Tier	Criteria	Response Time
Critical	Widespread client data compromise; privilege breach; mandatory reporting triggered	Immediate (24/7)
High	Multi-matter exposure; attorney email compromise	≤2 hours
Medium	Isolated access attempts; contained inadvertent disclosure	≤4 hours
Low	Blocked attempts; policy violations without data exposure