Skip to content

Cyber incident / breach to recovery

Trigger

A suspected or confirmed cyber incident may affect systems, data, customers, regulatory obligations or business operations.

Intended outcome

The incident is contained and eradicated, evidence is preserved, recovery is accepted by the business, notification decisions are traceable, and control remediation is closed or owned.

Workflow steps and gates

Step Accountable role Activity Handover Gate
1 Security Analyst Tier 1 detects and records the alert/incident with initial facts and provenance incident record with source/time/scope A real event or explicit false-positive rationale is recorded
2 Incident Responder triages severity, scope, likely attack path and immediate priorities triage decision and containment objectives Severity/scope have evidence and an accountable incident lead
3 Incident Responder contains affected assets/accounts while preserving reversibility and evidence containment actions and status Containment does not destroy material evidence without authority
4 Digital Forensics Examiner preserves and validates forensic evidence, chain of custody and timeline facts evidence register and forensic timeline Evidence integrity, time source and custody are documented
5 IT Risk Manager assesses business, service, security and regulatory impact using verified facts impact assessment with uncertainty and affected obligations Critical impact claims distinguish confirmed fact from inference
6 Data Protection Officer performs privacy/breach assessment and coordinates legal/regulatory decision inputs breach/notification decision basis Notification/non-notification has correct authority, clock and evidence
7 Incident Responder eradicates malicious persistence/root causes and verifies the environment eradication evidence and residual technical risks Known persistence and exploited control gaps are addressed or explicitly owned
8 Disaster Recovery Coordinator coordinates recovery sequencing, integrity validation and rollback/fallback readiness recovery evidence and service restoration status Recovery uses trusted state/data and respects RTO/RPO/business priorities
9 IT Service Owner validates business/service recovery and accepts restored operating state business recovery acceptance Service owner confirms agreed validation signals and residual limitations
10 Crisis Manager coordinates customer/regulator/executive communications decision and timing where required communication/regulatory action record Communications are authorised, consistent and evidence-based
11 Problem Manager runs lessons learned/root-cause analysis across people/process/technology lessons learned and systemic findings Findings address causes and failed controls, not only symptoms
12 Control Owner owns control remediation, target dates and evidence of completion control remediation plan Every material finding has a control owner, due date and verification method
13 Internal IT Auditor independently verifies closure evidence for material incidents where governance requires closure assurance result No open critical finding is silently closed or self-assured

Running this workflow: operator and implementer boundary

In Claude Code or Codex CLI, use the prompt in the next section (or adapt it to your programme): it is a provider conversation request, not a shell program named after this workflow. You supply the source materials, actual owners, gate acceptance and any authorisation for changing real systems. The provider agent interprets the registered workflow stages and role contracts, calls supported tools if allowed, and returns explicit evidence and blockers. Stage completion in the diagram or metadata is not proof of a successful external tool call, an approved exception or a released system.

For consequential decisions explicitly start /layered (Claude) or $workflow-layered (Codex); this version does not force every direct/natural-language workflow invocation into Fabric. Human L0 authority remains separate, with Codex requiring the actual human to run any protected authority command in a trusted terminal. See the interaction model, layered engagement and human authority.

How to use this workflow

A practical prompt pattern is:

Apply the cyber-incident-breach-to-recovery workflow to this situation. For each step, identify the current state, accountable role, required evidence, hand-over artefact, gate status and unresolved blocker. Do not skip a gate merely because the implementation is technically complete.

Operational interpretation

The workflow is most useful when the team keeps each hand-over explicit. The system can help generate or review the artefacts, but the accountable role and approval decision remain organisational responsibilities.