# Sample Falcon incident response plan

Kaitiaki Security | Starter template

Confirm contacts, response authority and service scope before using this plan.

## Roles

- CrowdStrike Falcon Complete: investigation and response within agreed scope.
- Kaitiaki: customer escalation and coordination.
- Customer incident lead and backup: ___ / ___
- Customer approver for business-impacting actions and backup: ___ / ___

## First hour

1. Record the Falcon case reference, detection time, affected devices and what Falcon has already done.
2. Assign an incident lead. Establish business impact, known facts and open questions.
3. Confirm who can approve additional containment. Log the decision, rationale and owner.
4. Agree who updates leadership, when the next update goes out and who checks external reporting obligations.
5. Assign a recovery owner and agree what evidence is required before restoring service.

Decision log: time and timezone | decision | rationale | approver | action owner | next review

## NZ reporting references

- [NCSC cyber incident reporting](https://www.ncsc.govt.nz/report/)
- [Privacy Commissioner NotifyUs](https://www.privacy.org.nz/responsibilities/privacy-breaches/notify-us/)