RespondPractice and strategy

Incident runbook builder

Fill a swimlane of roles against the SP 800-61r3 phases, capturing the action and the evidence to keep at each step.

How to use it
  1. Name the roles that respond: lanes in the swimlane.
  2. For each phase, write what that role does and the evidence to capture.
  3. The swimlane fills from what you type.
  4. Export the runbook so the team can rehearse it.

This tool reinforces detection and incident response. Your work autosaves to this browser. Use the download buttons on the figure for PNG and PowerPoint.