A runbook for the first hours that keeps its own log INCIDENT
In an incident the steps are known; the record is what never gets kept, because everyone is busy doing the incident. This runs the playbook and logs the run: times, decisions, evidence hashes and actions.
The incident
Where it stands
The steps
Actions
The timeline
The record
SHA-256 of everything above:
Doing this often? The OBSCURA Sovereign Suite keeps the incident log with its timeline, and runs tabletop exercises to rehearse the next one. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.