Severity ladder
| SEV | Trigger | Escalation | Notification |
|---|
| SEV-1 | Active breach, exfil, ransomware, CII | Immediate, war-room | NCA <= 1h; SAMA <= 2h; PDPL 72h |
| SEV-2 | Critical exposure, privileged compromise | Immediate | Mitigation start <= 24h |
| SEV-3 | High CVE, suspicious auth, phishing | Push | Register row <= 7d |
| SEV-4 | Compliance drift, expired cert | Push | <= 30d |
| SEV-5 | Informational | Note | - |
Incident command lifecycle (NIST SP 800-61r2)
- Prepare - playbooks, contacts, access ready.
- Detection & analysis - validate, scope, classify.
- Containment - isolate; preserve evidence before wiping anything.
- Eradication - remove the cause; patch the vector.
- Recovery - restore, verify clean, monitor closely.
- Post-incident - lessons learned, control fixes, close.
Roles
- Incident Commander (IC): decides, owns the bridge.
- Scribe: timestamps every action into the evidence file.
- Comms lead: internal + regulator + customer messaging.
- Tech lead: hands-on containment/eradication.
Evidence & chain of custody
Hash (SHA-256) every artifact; store under the incident slug; never alter originals.
Follow the legal hold if litigation is anticipated.
⚠️ Never publicly attribute an attack, contact threat actors, or pay a ransom without executive
+ legal authorisation.