Playbooks

A playbook means somebody has already worked out the first twenty steps, so nobody has to invent them at three in the morning.

The failure is writing them as documents nobody has read and nobody has tested. A playbook that assumes a system still exists, a person still works there, or a tool still behaves that way is worse than none, because it creates confidence. They need exercising, the same as backups.

Checked against the primary source.

More on Incident response