QA Pro AcademyCybersecurity A-Z
Join free
← Back to catalogue
Keeping the response library at Casterbridge Payments honest: playbook PB-017 was opened at 03:14 and abandoned at 03:41, so every step is rewritten with an actor, an action or decision, a named system, a next step and a failure branch, cutting it from 31 steps to 19; the playbook loop is drawn as a clock face with eight stages — purpose, step, decision, access, notify, exercise, harvest and library — and the 27 lost minutes marked on its rim; and notification clocks for merchants, the card scheme, the insurer and the regulator sit inside the flow, with 68 documents governed down to 34 playbooks and time to first decision cut from 34 minutes to 11.
CY-EXPERT-076Expert Level · Security Operations

Incident Response Playbook Review

An expert-level security operations course on keeping a response library honest, so that the document somebody opens at three in the morning actually carries them to a decision. Work round the loop - eight stages of a closed circle: what a playbook is for and what a runbook, a policy and a checklist are for instead; the anatomy of a step that survives pressure; the decisions that change an outcome and who holds each at 03:00; the tooling, access and break-glass a playbook assumes; the notification clocks that belong in the flow rather than in an appendix; exercising honestly and measuring rather than applauding; harvesting real incidents into revisions without breeding new documents; and governing the library by coverage and freshness in front of a committee that owns the gaps.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

  • Measure a response library by abandonment points, revision age, exercise age, step count and actor coverage, and publish a baseline whose measures can only improve through real work.
  • Apply a written four-way classification test that separates playbooks from runbooks, policies and checklists, and scope each playbook to one scenario family with a stated entry and exit condition.
  • Write steps to a five-part standard, convert topic-shaped lines into instructions, specify failure branches drawn from the incident record and the shift leads, and prove the result by cold read against a pre-fixed criterion.
  • Extract the decisions that materially change an outcome, separate isolation from preservation by measured platform facts, and give each decision a holder, an awake alternate, a measured window and a default that fires.
Price:৳12,000
Sign in to get access

Sign in to enrol — you can pay by bKash or Nagad, or apply a promo code.