CyberStack

Knowledge / IR

Incident response

Prepare, detect, contain, recover, learn. The first hour is decisions and evidence, not a slide template.

IR / NIST 800-61 style loopPrepareDetect + analyseContain + eradicateRecover + lessonsFirst hour is contain and preserve. Fancy write-up comes later.

IR is a capability. A PDF plan is a prompt. You need names, authorities, evidence handling, comms, and a way to isolate systems without asking a committee.

First hour: identify the channel, preserve volatility where it matters, contain obvious spread, notify the people who can actually decide, start a timeline.

In Australia, eligible data breaches also pull in OAIC notification. IR and privacy are the same event wearing two hats.