Cybersecurity
Control identity, endpoints, networks, and data—then validate with telemetry, drills, and real containment practice.
Identity
MFA, SSO, PAM
Endpoints
EDR, disk encryption
Telemetry
SIEM + retention
Resilience
Backups + DR
Filter by role:
Overall
0%
Controls
0%
Escalation
0%
72-Hour Flow
0%
Mark implemented items. Use the role filter to focus each team.
Identity & Access (IdP / MFA / PAM)
0%
Endpoints (EDR / Hardening)
0%
Network (Segmentation / Egress)
0%
Email & Web
0%
Logging & SIEM
0%
Backups & DR
0%
Vendors & Third-Party Access
0%
Privileged Operations
0%
Notify | Within | Channel | Log | Done |
---|---|---|---|---|
SOC Lead | 4h | Ticket | Alert ID, hypothesis | |
SecOps | 8h | Ticket | Action items |
Notify | Within | Channel | Log | Done |
---|---|---|---|---|
SOC + SecOps IC | 1h | Call + Ticket | Initial severity | |
IT | 2h | Ticket | Containment tasks | |
Legal (privileged) | 4h | Privilege notes |
Notify | Within | Channel | Log | Done |
---|---|---|---|---|
IC + CISO + Legal | 15m | Bridge + Secure chat | Decision log started | |
IR Retainer | 30m | Phone | Ticket ref / NDA |
Notify | Within | Channel | Log | Done |
---|---|---|---|---|
All-hands (IC, CISO, Legal, PR, HR, Exec) | Immediate | War-Room | Chronology live | |
Regulators/LE (as required) | 1h | Phone + Email | Preservation order |
Elapsed: 00:00:00
Started: —
T+0 to 1h — Stabilize & Preserve
0%
T+1 to 4h — Scope & Contain
0%
T+4 to 24h — Investigate & Eradicate
0%
T+24 to 72h — Recovery & Review
0%