Built for the first hard decisions
The protocol starts at declaration—not discovery—and helps the incident lead establish scope, authority, and a defensible containment strategy before operational pressure takes over.
What your team can use immediately
- A role-based first-hour checklist
- Containment thresholds for identity, endpoints, networks, and backups
- Evidence handling and decision-log templates
- Recovery criteria that keep reinfection risk visible