Incident Response Packet

If you are reading this during an incident

• Start with the Responder Brief — it tells your response team what this environment is and which security capabilities they can rely on.
• Open Notification Obligations within the first hours — the insurance-carrier clock is usually the shortest.
• Use the Kill-Chain Gap Overlay once observed attacker techniques are known; the live version in the portal accepts the incident's technique list.
• Hand Tool KEV History to whoever is forming the initial-access hypothesis.

Contents

1. Responder BriefEnvironment snapshot: identity provider, data types, staffing, and assessed capabilities with the evidence behind each status.
2. Kill-Chain Gap OverlaySample ransomware scenario mapped against assessed control coverage; containment actions split by what this organization can actually execute.
3. Tool KEV HistoryInventoried products with confirmed Known Exploited Vulnerabilities history — a triage ordering, not a vulnerability scan.
4. Notification ObligationsReporting duties likely triggered by a breach for this sector, location, and data profile, ordered by deadline.
5. Evidence Bundle (companion ZIP)Every evidence file submitted during the assessment and its check-ins, one folder per control, with a hash-verified index. Shipped as a separate download — share the reports freely; share raw evidence deliberately.
6. Remediation Crosswalk — reservedArrives with the capability question bank: post-incident findings mapped to every framework you maintain.

Custody and freshness

This packet is generated from your organization's own FrameworkMapper data and is encrypted with your organization key while stored on the platform. The downloaded copy in your hands is unencrypted by design — it exists so responders can read it when your identity provider, and therefore the portal, may be unreachable or contested.

Keep it where your incident response plan lives: printed in the break-glass binder, or on storage that is not domain-joined. Treat it as sensitive — it describes your gaps as well as your strengths.

The packet regenerates whenever the data feeding it changes (assessment save or check-in, tool inventory update, organization profile edit). Compare the generation date above against your last significant change; re-download after each assessment cycle.