The First 4 Hours: An Incident Response Field Guide — Volume 2: The Four Organisations, and After

Volume 2 of the three-volume First 4 Hours set: the incident response playbook run at four organisational maturity levels. Those are the solo operator, the MSP-served small business, the mid-market team, and the enterprise incident response function. The playbook is then bent around the four hardest incident shapes: ransomware, supply-chain compromise, the third-party breach, and insider and lost-device cases. It is carried into the aftermath: the post-incident review, regulatory follow-up after the window closes, and what to change before the next one. The post-incident review template set and the IR Maturity Self-Assessment ride along as appendices. This volume covers the organisations, the hard cases, and the aftermath. Volume 1 covers the four-hour playbook itself. Volume 3 is the Operator's Workbook of templates and decision aids. Each volume stands alone. Each is modestly priced in ebook.