What You Need To Do Before
Creating Your Playbooks
The pressure to come up with an effective incident response strategy can be onerous, and it can be tough deciding which incidents to create playbooks for. Make sure you choose the right strategies by following these easy steps.
Think of all the incidents that could affect your organization
Start by putting together a list of all incidents that occurred in the past few years, and list all incidents that are likely to find their way into your operational activities. We suggest meeting with each of your team to talk about the issues that previously affected their operations, or the ones that could affect them. No one knows your organization better than them.
Identify all the elements that could be improved
Take the time to reconstruct the scenario for each incident listed above. Discuss with your team about the actions that were made to solve the incident, and try to identify the problems within the response. Think about the elements that didn’t work, the areas for improvement, the best practices, as well as the sequence and timing of actions.
Look at the time needed to solve the incident, and figure out what would be the ideal response time. You may or may not find the information. This step is optional.
Do some research
Now that you know more about what’s happening inside your organization, it is time for you to scan your environment. As an incident response specialist, it is crucial that you understand threats from both your internal and external environment.
Get inspired by doing some research on incidents what occurred around you. Check out issues that affected your competitors, your providers, your clients and other companies in your area, and try to understand the pain points within their response. It will help you throughout the incident brainstorm process.
Choose your Top 10
Now that your list is completed, it’s time to choose your Top 10.
Our best tip is to question your management team on their main concerns and try to identify the ones that could be addressed with Cobalt. Screen all incidents listed above with your management team and your division managers. Take the time to evaluate your incidents, and choose a plausible scenario. Pay attention to the likelihood of their occurence, and their relative impact. Keeping the most critical activities and divisions among your organization in mind when you’re making your selection will help you build a better incident response strategy.
Once you’ll have 10 fully functional playbooks, you’ll be able to increase the overall performance of your organization. But first, we recommend that you start with 3 playbooks to fully understand the software.
Start with 3
We recommend that you start with 3 playbooks. The first 3 playbooks will help you fully understand the software, and get familiar with its environment. You’ll experience meeting with your teams, asking the questions, articulate the benefits of using workflows automation within your incident response. You’ll be able to prompt your teams to identify problems and to find strategies to solve them. After creating 3 playbooks, creating incident response processes will be easy.
Once you’ve identified the first 3 incidents you want to build playbooks for, you’re ready to create your playbooks in Cobalt.
Related resources
To respond to an incident, you need to have a clear idea of the context. Cobalt lets you dig a little deeper to gather details before, during, and after the incident.
Learn how to design effective playbooks by reading those highlights.
Read about the basics and best practices to consider when developing your playbooks.
See how Cobalt Reporting can help you prevent your organization from issues and improve your activities.
