Write a stepwise playbook for responding to misclassification or data spills. Define activation by [IncidentSeverityLevels], containment steps, forensic capture using [ForensicTool], and restoration with an [RTO] objective. Assign communications to [CommsOwnerRole] and include stakeholder messaging templates.
Output format:
“Runbook” (numbered steps grouped by Detect/Contain/Eradicate/Recover/Lessons Learned).
“RACI” (Markdown: Task | Owner | Consulted | Informed).
“Regulatory & Contractual Notifications” (table with trigger, deadline, recipient).
“Post-Incident Review Template” (sections and questions).
Provide clear criteria to close incidents and update controls/policies to prevent recurrence.