Lion Cipher Lab
Write a simple incident-response plan (before you need it)
- GRC / Compliance
- Beginner
- ~40 min
- Free · no account required
Why it matters
Sooner or later something goes wrong: an account gets phished, a laptop catches ransomware, a password ends up in a breach. The difference between a bad day and a disaster is almost never how technical you are in the moment — it is whether you already know what to do and who to call. A plan written at 2am, mid-breach, while you are panicking and cannot remember your bank's fraud line, is worthless. Written now, calmly, on one page, it turns a crisis into a checklist. Incident response is a core function of every serious security program, and drafting even a one-page plan is a real,…
What you'll learn
- incident response
- IR plan
- NIST IR phases
- runbooks
- containment and recovery
Steps in this lab
- Why write this now, not at 2am
- The four phases your plan is built on
- Phase 1 — Preparation: the work you do before anything breaks
- Phase 2 — Detection and Analysis: know when something is actually wrong
- Phase 3 — Containment, Eradication, and Recovery: stop it, clean it, come back safely
- Phase 4 — Post-Incident Activity: the step everyone skips
- Contacts and a runbook for one real scenario
- What you just did — and why it counts