iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
At a U.S. federal civilian executive branch (FCEB) agency, respond to a cybersecurity incident by activating the approved incident-response plan, organizing the right decision-makers, assessing and containing the threat while protecting evidence and mission services, reporting to CISA on time, and then eradicating the attacker’s access and restoring systems in a controlled way. Keep a time-stamped record of what happened, what the agency did, and why.
Who should use this response guidance?
CISA’s Federal Government Cybersecurity Incident and Vulnerability Response Playbooks set out a standardized response process for FCEB agencies. The incident playbook is intended for confirmed malicious cyber activity when a major incident has been declared or has not yet been reasonably ruled out. CISA says its broader practices may also help other organizations, but the federal reporting requirements described here should not be assumed to apply outside the FCEB. Read CISA’s playbooks.
CISA directives apply to federal civilian agencies but exclude statutorily defined national security systems and certain systems operated by the Department of Defense or the Intelligence Community. Agency security leadership and counsel should confirm which rules govern the system and incident at hand. CISA’s directives page describes their scope.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What should the agency do first?
- Activate the approved incident-response plan. Identify the incident lead, open a secure communications channel, and start a time-stamped event log and decision record. Use the agency’s current procedures rather than improvising a separate chain of command.
- Bring in the right agency stakeholders. Include the CIO and CISO functions, affected mission and system owners, and privacy leadership if personal information may be involved. The CISA playbook identifies those officials as part of major-incident analysis; it names the Senior Agency Official for Privacy when the incident involves a breach. Engage legal, communications, continuity, law-enforcement, and contract contacts as the agency plan requires.
- Assess the threat and preserve evidence. Establish what was observed, when it began, which systems or data may be affected, whether malicious activity is continuing, and which mission services are at risk. Preserve relevant logs, endpoint and network telemetry, identity records, and communications; capture volatile evidence when feasible. Record timestamps and evidence provenance, restrict access to incident records, and coordinate handling with investigators and counsel. Avoid destructive cleanup before responders have captured evidence needed to understand scope and persistence.
- Choose containment actions based on the situation. Depending on the threat and operational impact, responders might isolate a host or network segment, disable compromised credentials, block indicators, restrict remote access, or move a service to a known-good environment. Document the approver, expected effect, and operational risk for each action. A measure that limits an attacker’s reach may also disrupt a critical service or destroy useful evidence, so no single action is right for every incident.
CISA recommends identifying response points of contact and surge support to cover staffing gaps. The agency can also plan coordination with contractors and service providers as appropriate. CISA’s joint guidance discusses points of contact and surge support.
When must a federal civilian agency notify CISA?
Under CISA’s federal playbook, the agency should send CISA an initial incident report within one hour after incident determination. If a major incident is declared, CISA must receive the report within one hour after the declaration, even if the agency’s internal reporting chain has not finished its review. These are FCEB timings; use the agency’s current approved reporting route and confirm any other applicable obligations. CISA’s playbook cites the federal notification guidance and OMB M-20-04 for these deadlines.
The playbook excerpt does not establish one universal operational channel for every agency. Check the agency’s maintained incident contacts and current CISA instructions. CISA’s reporting guidance lists an online reporting page, 1-844-Say-CISA (1-844-729-2472), and contact@mail.cisa.dhs.gov; verify that these details and the agency’s routing are current before using them operationally. CISA reporting guidance.
What should the initial report include?
Send what is known promptly and distinguish confirmed facts from estimates or unanswered questions. Include the information available about:
Rank #2
- the affected systems, data, and mission functions, and the incident timeline;
- the indicators and observed malicious activity, including relevant atomic or behavioral indicators;
- current operational impact and whether activity may still be ongoing;
- containment actions taken and the response status; and
- remaining work and estimates for containment, eradication, and recovery.
Update CISA when material facts change, including incident scope, timeline, indicators, impact, and response status. Share relevant indicators and countermeasures, continue updates until eradication is complete, and provide post-incident updates as directed by CISA. The federal playbook describes this ongoing coordination.
How should the agency eradicate the threat and restore services?
Eradicate access and remediate weaknesses
Once responders have enough information to understand the attacker’s access and persistence, remove malicious artifacts and address exploited weaknesses. Rotate affected credentials and secrets when appropriate, considering dependencies and operational impact. Coordinate remediation with the owners of affected systems and mission services; the right technical actions depend on the incident and agency plan.
Rank #3
Restore and validate in a controlled way
Restore from trusted sources, coordinate the return to service with mission owners and continuity staff, and monitor closely for renewed activity. Before treating recovery as complete, verify that services are functioning and security monitoring is working. The CISA playbook provides the overall response and recovery lifecycle; specific recovery steps must be tailored to the affected system and agency procedures. CISA’s playbooks.
Capture lessons and improve readiness
Record what helped or delayed the response, what information was missing, and which policies, logging practices, staffing arrangements, or vendor coordination need improvement. The FY 2025 Inspector General FISMA Reporting Metrics assess whether agencies have incident-handling processes for containment, eradication, recovery, and protection of incident data and metadata. See the FY 2025 metrics.
What if the organization is not an FCEB agency?
State, local, tribal, territorial, foreign, and private organizations should follow their own incident plans and applicable reporting rules. They may find CISA’s response practices useful, but should not treat the FCEB deadlines or agency reporting chain in this guide as their own requirements. Confirm the governing rules with the organization’s security leadership and counsel.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
