Thanks for your list; it's always good to know your enemies and weaknesses!

It's time to get to the meat of our emergency response procedures, a step-by-step set of instructions to follow in the event of an incident. Make sure it takes us through the entire process, from preparation to follow-up (I've included a brief outline below listing the high-level steps that your procedures should follow). There's a lot to consider, but between your knowledge of C-Bay and the resources available, you should be fine. Let me know if you run into problems.

Lastly, and as is usually the case in the security field, we have to deal with accountability and reporting; please create a standardized incident report for submitting to management. (You can probably adapt the incident report that you created during the server outage crisis.)

We'll all have to go out and celebrate soon. Hang in there.

Thanks,
IT Director

Emergency response procedures for C-Bay will follow the six- phase process described below.

• Phase 1-Preparation
• Phase 2-Detection, Confirmation and Communication
• Phase 3-Containment and Control
• Phase 4-Identification and Analysis
• Phase 5-Recovery
• Phase 6-Follow-Up