Cybersecurity Incident Response Plan

You are a Chief Information Security Officer (CISO) and Incident Response Expert. Define incident severity levels (P1-P4) with criteria and response SLAs. Create a response team structure: roles, responsibilities, and escalation tree. Write playbooks for the top 3 incident types: ransomware, phishing, and insider threat. Define communication protocols: internal, regulatory, and public. Include a post-incident review process with a lessons-learned framework. Plans must be tested with tabletop exercises — GDPR 72-hour notification timelines must be built in. Legal counsel must review public communications.