Incident › Module 2 › Lesson 1
Policy Procedures
Policy procedures literacy names IR policy, standard operating procedures, and escalation paths — read plan tiers on YOUR $IR_LAB notes before live incident activation.
Visual · t34_policy_procedures
Policy procedures literacy. $IR_LAB only. Original Cyberlium.
Opening
Plans beat panic — literacy teaches IR policy and procedure structure on tabletop notes you own before production incident declaration.
IR policy defines when an event becomes an incident, who can declare, and what evidence handling rules apply. Procedures spell step-by-step actions — intake form fields, severity assessment, comms templates. Escalation paths name who gets paged at each tier. Literacy names these documents before you run a drill. Cyberlium maps policy procedures on YOUR $IR_LAB — document fictional policy excerpts and procedure steps on paper. Next: Severity Matrix.
1. IR document tiers (named)
Policy: board-approved rules — incident definition, authority to declare, legal hold triggers. Procedures: repeatable steps — intake, triage, evidence chain. Runbooks: tool-specific commands for YOUR org assets only. Escalation matrix: who to notify by severity and time of day.
On $IR_LAB, write one fictional policy sentence and one procedure step for a tabletop phishing inject.
Command guide
Try these commands — IR document tiers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final ISO/IEC 27035 — https://www.iso.org/standard/78973.html SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
curl -sS https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final | head -10
cat > "$IR_LAB/planning/ir-policy-stub.md" <<'EOF'
# Incident Response Policy — YOUR org stub
## Purpose
Define scope, authority, and minimum response for security incidents affecting YOUR org.
## Scope
All systems, data, and personnel under YOUR org control — tabletop lab uses fictional assets only.
## Policy statements
1. All suspected incidents reported within 1 hour to IR lead
2. Preserve evidence before remediation when feasible
3. Escalate by severity matrix — see severity-matrix.md
4. External notification per legal/compliance playbook
5. Post-incident review required for Sev-2+ within 14 days
## Prohibited
- Ransomware builders; paying criminals without exec/legal approval
- Containment on stranger/unauthorized hosts
EOFCommand — copy this
grep -E 'Purpose|Severity|Prohibited' "$IR_LAB/planning/ir-policy-stub.md"
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); ISO/IEC 27035 (https://www.iso.org/standard/78973.html); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why policy literacy prevents rogue IR
Ad-hoc containment without policy backing creates legal and operational risk. Missing escalation paths delay executive and legal involvement. Mature IR programs version-control policy and test procedures in tabletops.
Students label document types on lab notes — never run destructive containment on employer production without declared incident and ticket scope.
3. Lab boundary
Forbidden: treating personal lab notes as binding policy for stranger organizations. Allowed: policy procedures card — four document types with $IR_LAB fictional examples.
Ship: policy procedures card for YOUR lab notes. Next: Severity Matrix.
4. What you ship: policy procedures card for $IR_LAB
Four document types with fictional lab examples. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Policy procedures card. $IR_LAB named. File t34-m02-l01-policy-procedures.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip policy and isolate systems ad hoc. Copy live victim IR policy without redaction.
Right
Write policy procedures card for YOUR $IR_LAB. Next: Severity Matrix.
Mission: map IR policy on YOUR lab
1) Define policy, procedure, runbook, escalation in one sentence each. 2) Write one fictional example per type. 3) Name which role owns each document. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Policy answers 'may we?' — procedures answer 'how do we?' Label before you drill.
Knowledge Check
APPLY: IR policy primarily defines:
Multiple choice
Knowledge Check
APPLY: True or False: Procedures spell repeatable step-by-step IR actions.
True or False
Knowledge Check
APPLY: Policy procedures literacy on Cyberlium uses:
Multiple choice