Incident response glossary

Keep three copies of your data: the live copy plus two backups, on two different kinds of storage, with one copy held in a separate location. It protects against a single failure taking everything out. Against ransomware it is a starting point, because many variants hunt for backups they can reach from the network and delete or encrypt them. Teams usually add an offline or immutable copy for that reason.

See also: Immutable backup, Air-gapped backup, Ransomware Sources: vita.virginia.gov, cisa.gov

The cybersecurity regulation of the New York Department of Financial Services, which applies to banks, insurers, licensed lenders and other firms it licenses. It requires written incident response and business continuity plans, tested at least annually. A covered entity must notify the Department within 72 hours of determining that a cybersecurity incident has occurred, and within 24 hours of making an extortion payment, with a written explanation to follow within 30 days.

See also: Incident response plan, Board oversight of cyber risk, vCISO Sources: dfs.ny.gov

When an attacker gains control of a legitimate account, such as email, cloud or banking, and acts as its owner. The route is usually a stolen or guessed password, a tricked MFA approval or a convincing call to the help desk. In a tabletop it raises two questions: who can force a sign-out and reset, and how do we find what the account touched?

See also: Credential stuffing, MFA fatigue, SIM swap Sources: cisa.gov

The written record of an exercise or a real incident: what happened, what worked, what didn't and what will change. In HSEEP it's paired with an improvement plan, so each finding gets an owner and a date. For a board, an auditor or an insurer, it's the evidence that testing took place and led to something.

See also: Improvement plan, After-action review, Hotwash Sources: fema.gov

A structured team conversation, held soon after an event, that asks what was supposed to happen, what did happen, why the two differ and what to do next time. It's quicker and less formal than an after-action report. The review gathers people's views, and the report records them.

See also: After-action report (AAR), Hotwash, Post-incident review Sources: appel.nasa.gov, pslhub.org

A backup copy with no live network connection, so an attacker who controls your systems cannot reach it. Strictly, an air gap means no physical connection and no automated logical one: data moves only under human control, as with rotated tapes or drives kept offline. A logical separation, such as a locked-down cloud account, can be weaker. The Canadian Centre for Cyber Security advises keeping backups encrypted and offline.

See also: Immutable backup, 3-2-1 backup rule, Ransomware Sources: csrc.nist.gov, cyber.gc.ca, ibm.com

An attack vector is the route an attacker uses to reach a system or person: a phishing email, a stolen password, an unpatched server facing the internet, a compromised supplier. Responders try to name it early, because rebuilding systems without closing the same door invites a repeat. For example, a remote access portal with no second factor is an attack vector, and fixing it belongs on the recovery list.

See also: Initial access, Root cause analysis, Threat actor Sources: csrc.nist.gov

In the US this is attorney-client privilege. In Canada it is solicitor-client privilege, with litigation privilege covering material prepared mainly for expected litigation. Both can protect legal advice and, sometimes, forensic work done for counsel. Courts look at the main purpose of a report, so routine IT investigation work can lose protection, and relying on a report in court can waive it. Many response plans have counsel engage the forensic firm for this reason.

See also: Breach coach, Legal hold, Panel counsel Sources: mccarthy.ca, blg.com

Bill C-8 received Royal Assent on 15 June 2026 and revived the framework of the earlier Bill C-26, which carried the same title. It amends the Telecommunications Act and enacts the Critical Cyber Systems Protection Act, which lets the federal government designate operators in sectors such as telecommunications, finance, energy and transportation. Designated operators must run cyber security programs that cover supply chain risk, and report incidents. Their suppliers may see this in contract and questionnaire requests.

See also: CIRCIA, OSFI Guideline B-13, Third-party breach Sources: parl.ca, parl.ca, canada.ca, parl.ca

The board's responsibility to understand how the organization manages cyber risk, set expectations for management and check the results. That means regular reporting from whoever runs security, a view on risk appetite and response readiness, and a standing place on the agenda. Some rules spell it out: US public companies must describe board oversight in annual reports, and New York's financial regulation requires the board to review management reports and confirm resources are allocated. Four questions a board can ask.

See also: Cyber risk appetite, Risk register, 23 NYCRR 500 Sources: ecfr.gov, dfs.ny.gov

Software that automatically runs simulated attack techniques against your own environment to check whether your security controls detect or block them. It's a technical test, often run on a schedule, and the term comes from the security industry rather than a standard. It doesn't test people, decisions or communications, so it complements a tabletop and doesn't replace one.

See also: Purple team exercise, Red team exercise, Cyber range Sources: ibm.com, en.wikipedia.org

A breach coach is a lawyer who specializes in privacy and cybersecurity and leads the legal side of a cyber incident. Many cyber insurers give policyholders access to one through a panel and an incident hotline. The coach advises on notification duties in Canada or the US, brings in forensic and other vendors, and helps manage communications, often under legal privilege. Call before hiring anyone yourself, because some policies pay only for panel vendors.

Read the full entry →

See also: Panel counsel, Cyber insurance, Attorney-client privilege in incident response Sources: travelers.com, mltaikins.com

The federal regulations (SOR/2018-64) that fill in PIPEDA's breach rules, in force since 1 November 2018. They set out what a report to the Privacy Commissioner and a notice to affected individuals must contain. They also require a record of every breach of security safeguards, kept for 24 months after the organization determines the breach occurred, with enough detail for the Commissioner to verify compliance. Breaches below the reporting threshold still get recorded.

See also: PIPEDA, Real risk of significant harm (RROSH), Security incident report Sources: laws-lois.justice.gc.ca, laws-lois.justice.gc.ca

The ongoing program an organization uses to keep critical operations running through a disruption and to restore them afterward. It covers analyzing what matters most, writing plans, assigning owners, training people, exercising the plans and improving them over time. The business continuity plan is one output of the program, not the whole of it. ISO 22301 is the international standard for a business continuity management system.

See also: Business continuity plan (BCP), Business impact analysis (BIA), Operational resilience Sources: dqsglobal.com, ready.gov

NIST describes a business continuity plan as a predetermined set of instructions for sustaining an organization's mission and business processes during and after a significant disruption. It typically covers recovery priorities, roles, manual workarounds, alternate locations and contact lists. A plan nobody has exercised is a draft. A disruption is a poor time to find the gaps. How to test one.

See also: Business continuity management, Disaster recovery plan, Business impact analysis (BIA) Sources: csrc.nist.gov, ready.gov

A fraud in which an attacker uses a real or spoofed email account of a trusted person, such as an executive or supplier, to trick staff into sending money or information. There's often no malware involved, only a convincing message. Speed matters, because a transfer has a better chance of being recalled if the bank hears quickly. The tabletop question is who makes that call.

See also: CEO fraud, Invoice fraud and payment diversion, Social engineering fraud coverage Sources: antifraudcentre-centreantifraude.ca, antifraudcentre-centreantifraude.ca

A business impact analysis is a structured review of which business functions matter most, what each one depends on, and how fast harm builds if it stops. It produces a ranked list with recovery targets such as RTO and RPO. In an incident it tells leadership what to restore first, so that decision isn't made by argument under pressure.

Read the full entry →

See also: Recovery time objective (RTO), Recovery point objective (RPO), Critical business functions Sources: csrc.nist.gov, ready.gov

Cyber coverage that typically pays lost income and extra expenses when a cyber event or system outage stops or slows the insured's operations. It usually responds only after a waiting period, runs for a defined period of restoration and may carry a sublimit. Triggers differ: some policies cover attacks only, others also cover system failure or an outage at a vendor. For example, a cloud provider outage may or may not count.

See also: Waiting period (business interruption), Contingent business interruption, Sublimit Sources: corvusinsurance.com, crcgroup.com

A pre-agreed list of who contacts whom, in what order, to activate a response, so one person does not have to phone everyone. Each person calls a few others and passes the message along. It needs current mobile numbers, a backup for each person and a channel that works when email and chat are down. A call tree stored only on the corporate network is no help in a ransomware incident.

See also: Out-of-band communication, Incident response plan, Crisis management team Sources: cyber.gc.ca, ready.gov

A form of BEC in which the attacker poses as a senior executive and pressures an employee, often in finance, to make an urgent payment or buy gift cards. The Canadian Anti-Fraud Centre describes both variations. It works because people hesitate to question the boss, so the control has to be a rule that applies to everyone: confirm payment requests through a second channel.

See also: Business email compromise (BEC), Spear phishing, Deepfake fraud Sources: antifraudcentre-centreantifraude.ca

A chain of custody is the written record of who collected a piece of evidence, who held it afterward, when it changed hands and why. It applies to laptops, disk images, logs and exported emails. Gaps give someone room to argue the evidence was altered, which matters if the incident ends up in an insurance dispute, a regulator's review or court. Label items, log every handoff and store them securely.

See also: Evidence preservation, Forensic image, Digital forensics Sources: csrc.nist.gov

The US Cyber Incident Reporting for Critical Infrastructure Act of 2022. It directs CISA to write rules requiring covered critical infrastructure entities to report covered cyber incidents within 72 hours and ransom payments within 24 hours. The duties apply only once CISA's final rule takes effect, and the August 2026 federal regulatory agenda still listed that rule as pending. Until then, CISA encourages voluntary reporting.

See also: Bill C-8 and the Critical Cyber Systems Protection Act, SEC cybersecurity incident disclosure (Form 8-K Item 1.05), Ransomware Sources: cisa.gov, federalnewsnetwork.com, federalregister.gov

A policy that responds only to claims first made against you, and reported to the insurer, during the policy period or an extended reporting period. The incident can have happened earlier, within limits set by the retroactive date. Cyber liability coverage is often written this way. So report a possible claim promptly, and know what tail coverage exists if the policy ends or is not renewed.

See also: Retroactive date, Cyber insurance, Proof of loss Sources: unitedingratitude.aon.com, reedsmith.com

Command and control, or C2, is the channel an attacker uses to send instructions to compromised machines and collect data from them. It often looks like ordinary web traffic to an outside server, with regular check-ins sometimes called beaconing. Spotting C2 traffic is a common way to confirm that a machine is compromised, and blocking it cuts the attacker's control while you work on the rest.

See also: Containment, Indicators of compromise (IOCs), Lateral movement Sources: attack.mitre.org, cyber.gc.ca

Quebec's term for a privacy breach: unauthorized access to, use of or communication of personal information, its loss, or any other breach of its protection. Under the private sector privacy act, an enterprise must take reasonable steps to reduce the risk of harm. If the incident poses a risk of serious injury, it must promptly notify the Commission d'accès à l'information and the people concerned. It must also keep a register of incidents and send the Commission a copy on request.

See also: Quebec Law 25, Privacy breach, Real risk of significant harm (RROSH) Sources: legisquebec.gouv.qc.ca, legisquebec.gouv.qc.ca

Containment means limiting an incident's spread and damage while you work out what happened: isolating a laptop, disabling an account, blocking a domain, cutting a site off the network. It's a trade-off, because isolating systems protects data but can stop the business, so executives often have to approve it. Example: unplugging an infected office from the network is containment. Cleaning the machines afterward is eradication.

See also: Eradication, Recovery (incident response), Incident commander Sources: cyber.gc.ca, csrc.nist.gov

Contingent business interruption is cyber insurance cover for lost income when an outage at a provider you rely on, such as a cloud, payment or software vendor, stops you operating even though your own systems are fine. Insurers also call it dependent business interruption. Which providers count, whether accidental outages count, and the waiting period all depend on the policy wording. Example: your hosted e-commerce platform is hit by ransomware and you can't take orders for two days.

Read the full entry →

See also: Business interruption coverage, Waiting period (business interruption), Sublimit Sources: corvusinsurance.com, blog.ryanspecialty.com

US government planning for keeping an agency's mission essential functions going after a disaster. NIST SP 800-34 (2010) describes a COOP plan as predetermined instructions for sustaining those functions within 12 hours and for up to 30 days before a return to normal operations. Private organizations more often say business continuity, and the practical content overlaps. COOP turns up mostly in US public sector contracts and agency guidance.

See also: Business continuity plan (BCP), Disaster recovery plan, Critical business functions Sources: csrc.nist.gov

The staff guide for an exercise, covering the timeline, roles, injects and what evaluators should watch for. HSEEP describes it as specific information and guidance for controllers and evaluators. It's kept from players because it shows what's coming. In a small tabletop, the facilitator's own guide often does the same job.

See also: Exercise controller, Exercise evaluator, Master scenario events list (MSEL) Sources: fema.gov

In FEMA's US framework, the list of capabilities that exercise objectives are tied to, such as Planning, Operational Coordination, Public Information and Warning, and Cybersecurity. Planners pick the capabilities an exercise will test, and evaluators judge performance against them. A Canadian organization can borrow the structure without needing the labels.

See also: SMART objectives, Exercise evaluation guide (EEG), HSEEP (Homeland Security Exercise and Evaluation Program) Sources: fema.gov, fema.gov

A specific fix for a weakness found in an exercise or incident, such as rewriting an escalation step or adding a backup contact. HSEEP records corrective actions in the improvement plan with an owner and a due date. A good one names a task, not an intention: "update the call list by month end", not "improve communication".

See also: Improvement plan, After-action report (AAR), Lessons learned Sources: fema.gov

An automated attack that tries username and password pairs leaked in earlier breaches against other sites' login pages, counting on people to reuse passwords. OWASP treats it as a subset of brute force. It usually shows up as bursts of failed logins with a few successes. The decisions: when to force resets, who reviews the successful logins, and whether customer accounts were reached.

See also: Account takeover, MFA fatigue, Data breach Sources: community.owasp.org

Crisis communications is how an organization tells staff, customers, regulators, insurers, the board and the public what's happening during an incident. The aim is statements that are accurate, consistent and approved, from one owner. The usual failures are guessing at the cause, saying no data was taken before anyone knows, and letting several people give different answers.

See also: Holding statement, Spokesperson, Crisis management team Sources: cyber.gc.ca, nvlpubs.nist.gov

The plan for how leaders make decisions and communicate when an event threatens the organization as a whole, not just one system or site. It names the crisis team, who has authority to decide, how the team convenes, who speaks to staff, customers, regulators and the media, and how decisions are recorded. It sits above the incident response and continuity plans and draws on both.

See also: Crisis management team, Crisis communications, Incident response plan Sources: cyber.gc.ca, ready.gov

The crisis management team is the senior group that makes business decisions during a serious incident: whether to shut down a system, who to notify, what to tell customers and when. It usually draws on executives, legal, communications, HR and operations, with a technical lead reporting in. The incident response team investigates and advises. The crisis team decides, and exercises often show who thought they were in charge.

See also: Crisis communications, War room, Incident commander Sources: cyber.gc.ca

A scenario run to practise how leaders make decisions and communicate under pressure. The term has no single standard definition, so formats range from a facilitated discussion to a timed exercise with simulated calls, emails and news coverage. So it's worth asking what will happen in the room, who plays outside parties and what the written output is.

See also: Tabletop exercise (TTX), Crisis management team, Crisis communications Sources: documents1.worldbank.org, ssi.gouv.fr

The activities an organization must keep running, or restore first, because stopping them quickly causes serious financial, legal or operational harm. Taking orders, paying staff, dispatching vehicles and processing claims are typical examples. A business impact analysis identifies them and the systems, people and suppliers each one depends on. Recovery priorities, and the scenarios you exercise, should follow this list rather than the IT inventory.

See also: Business impact analysis (BIA), Dependency mapping, Recovery time objective (RTO) Sources: ready.gov

A CSIRT (computer security incident response team) or CIRT (computer incident response team) is the group that handles cyber incidents: it works out what happened, contains it and helps the business recover. The two names mean the same thing. In a mid-size organization it's usually a virtual team of IT, legal, communications and an outside responder, so a tabletop should ask who is on it and how you'd reach them with email down.

Read the full entry →

See also: Incident response team, Security operations centre (SOC), Incident commander Sources: csrc.nist.gov, cyber.gc.ca

Coverage that typically pays for responding to an extortion threat, such as a ransomware demand or a threat to publish stolen data. It often includes investigation and negotiation costs and, in some policies, the payment itself. Insurers commonly require notice, and often written consent, before any payment is made, and policies differ on what counts as a covered threat. The decision about paying belongs in the plan before an incident, not during it.

See also: Ransomware, Double extortion, Incident response panel (insurer) Sources: rmmagazine.com, northbridgeinsurance.ca

Insurance that helps pay for the costs of a cyber incident, such as forensics, legal advice, notification, data recovery, extortion response, lost income and claims by others. Wordings vary by insurer, so limits, retentions and exclusions matter as much as the premium. Renewal often involves questions about security controls and whether the incident response plan has been tested. A renewal readiness checklist.

See also: First-party and third-party cyber coverage, Underwriting (cyber insurance), Cyber insurance application Sources: insurancebusinessmag.com, content.naic.org, cira.ca

The form, usually with a security questionnaire attached, that an organization completes so an insurer can decide on coverage and price. It asks about revenue, the data you hold and controls such as multi-factor authentication, backups and incident response testing. Insurers rely on the answers, and they can be checked after a loss, so each "yes" should be one you can back with evidence. A decoder for the incident response questions.

See also: Security questionnaire, Underwriting (cyber insurance), Cyber insurance Sources: cira.ca, insurancebusinessmag.com, beazley.com

A virtual lab, a safe sandbox, where technical staff practise attack and defence on realistic systems. NIST describes it as a way to deliver hands-on, realistic training, scenarios and exercises. A range builds technical skill, such as spotting and containing an intrusion. It doesn't test executive decisions, legal calls or communications, which a tabletop covers.

See also: Red team exercise, Purple team exercise, Tabletop exercise (TTX) Sources: csrc.nist.gov

In NIST's wording, the ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises. It goes beyond prevention: the question is how well the organization keeps operating, and recovers, when something gets through. Backups that restore, a tested response plan and known dependencies are the practical signs.

See also: Operational resilience, Business continuity management, Immutable backup Sources: csrc.nist.gov

The kind and amount of cyber risk leadership is willing to accept in pursuit of its goals, set at a broad level. NIST describes risk appetite as the types and amount of risk an organization is willing to accept in pursuit of value. A statement might say how long a critical system can be down or how much data loss is tolerable. It guides spending and sets which risks go to the board.

See also: Risk acceptance, Risk register, Board oversight of cyber risk Sources: csrc.nist.gov, osfi-bsif.gc.ca

Estimating cyber risk in money rather than red, amber and green ratings: how often a type of loss might happen and what it could cost. Methods such as FAIR, an open standard model, turn scenarios like ransomware or a vendor outage into loss ranges. The results support decisions about controls, risk acceptance and how much insurance to carry. They are estimates built on assumptions, so the assumptions should be written down.

See also: Risk register, Cyber risk appetite, Underwriting (cyber insurance) Sources: fairinstitute.org

A competitive exercise in which teams take opposing roles, such as attackers and defenders, to explore the consequences of each side's decisions. HSEEP counts games as discussion-based. A cyber war game suits strategy questions, such as how an attacker might think, better than it suits testing an organization's own response plan.

See also: Discussion-based exercise, Red team exercise, Tabletop exercise (TTX) Sources: emilms.fema.gov, fema.gov

A data breach is an incident in which data is accessed, disclosed, lost or stolen without authorization. Not every incident is one: ransomware that locks files without anyone copying them may not count, depending on the facts and the law. Legal definitions differ. In Canada, PIPEDA turns on a breach of security safeguards involving personal information, and each US state sets its own rules.

See also: Privacy breach, Real risk of significant harm (RROSH), Data exfiltration Sources: priv.gc.ca, laws-lois.justice.gc.ca

Data exfiltration is the unauthorized removal of data or files from a system by an intruder: in plain terms, data theft. It turns an outage into a possible privacy breach and gives attackers something to threaten you with. Whether data left, and which data, is often the hardest question in an incident, and it depends on having kept logs that cover the period.

See also: Command and control (C2), Data breach, Lateral movement Sources: cyber.gc.ca, attack.mitre.org

A website run by an extortion group where it lists victims and posts stolen data from those who refuse to pay. The Cyber Centre describes these sites as a pressure tool. A listing can be how a customer or a reporter first hears about an incident. Someone has to verify the claim and decide what the organization says in reply, and a tabletop is a cheap way to find out who.

See also: Double extortion, Holding statement, Data breach Sources: cyber.gc.ca, cyber.gc.ca

A distributed denial-of-service attack uses many compromised systems to flood a target with traffic, so legitimate users can't get through. It disrupts service rather than breaking in, though attackers sometimes use it as added pressure during an extortion. A tabletop checks who calls the internet provider or mitigation service, and what customers are told.

See also: Triple extortion, Ransomware, Crisis communications Sources: cyber.gc.ca, cyber.gc.ca

A decision log is a running record of the decisions made during an incident: what was decided, by whom, at what time and on what information. It feeds the post-incident review and answers later questions from insurers, regulators or auditors about why systems were taken offline or why customers were told when they were. One named person should keep it, not whoever has a spare moment.

See also: Post-incident review, Crisis management team, After-action report (AAR) Sources: cyber.gc.ca

Fraud that uses AI-generated or altered voice, video or images to impersonate someone, such as an executive on a call asking for a payment. The FBI has warned that criminals use generative AI, including voice cloning and live video, to make fraud more convincing. Spotting glitches helps, but the dependable control is confirming the request through a second channel, using contact details you already hold.

See also: CEO fraud, Vishing, Business email compromise (BEC) Sources: ic3.gov

Documenting what each critical function relies on: systems, data, people, suppliers, facilities and utilities, and what those rely on in turn. The map shows single points of failure and the order in which things must come back. It is where hidden dependencies surface, such as one cloud login service or one payroll vendor that several functions share.

See also: Business impact analysis (BIA), Single point of failure, Critical business functions Sources: ready.gov, osfi-bsif.gc.ca

DFIR stands for digital forensics and incident response. It describes both the work and the specialist firms that do it: investigating what happened, how the attacker got in and what they touched, while helping stop the attack and restore operations. The two halves can pull against each other, since fast recovery can destroy evidence, so someone needs to decide what to preserve before systems are rebuilt.

See also: Digital forensics, Evidence preservation, Forensic image Sources: csrc.nist.gov

Digital forensics is the collection and analysis of data from computers, phones, networks and cloud services, using methods that keep the evidence intact and its handling documented. NIST describes it as applying scientific methods to identify, collect, examine and analyze data while preserving its integrity and a strict chain of custody. In an incident it establishes the timeline, the entry point and what data was touched.

See also: Chain of custody, Forensic image, DFIR Sources: csrc.nist.gov

NIST defines it as a written plan for recovering one or more information systems at an alternate facility after a severe failure or loss of facilities. It is the technology side of recovery: which systems come back in what order, from which backups, by whom. It supports the business continuity plan, which covers the people and processes around the technology. Recovery time and recovery point objectives set its targets.

See also: Business continuity plan (BCP), Recovery time objective (RTO), Recovery point objective (RPO) Sources: csrc.nist.gov, cyber.gc.ca

Checking that systems and data can actually be restored within the time the business needs. Tests range from walking through the plan, to restoring a backup into an isolated environment, to a full failover to the recovery site. Some regulators require it: New York's financial regulation calls for at least annual tests of the plans and of the ability to restore critical data from backups. A backup that has never been restored is an assumption.

See also: Failover and failback, Immutable backup, Disaster recovery plan Sources: dfs.ny.gov, cyber.gc.ca, rubrik.com

In HSEEP, an exercise where people talk through plans, policies and roles instead of performing them. Seminars, workshops, tabletop exercises and games all belong to this group. A facilitator usually leads, and the focus is on strategic and policy questions: who decides, who is told, and what the plan says. Nobody operates real systems.

See also: Tabletop exercise (TTX), Operations-based exercise, Facilitator Sources: emilms.fema.gov, fema.gov

A ransomware tactic in which attackers steal data before encrypting it, then press for payment on two grounds: a key to restore the systems and a promise not to publish the stolen files. Restoring from backup no longer ends the incident. The organization must work out what was taken and who has to be told, which brings legal and privacy advice in early.

See also: Ransomware, Triple extortion, Data leak site Sources: cyber.gc.ca, cyber.gc.ca, cisa.gov

The manual workarounds people use when systems are unavailable: paper forms, downtime kits, printed contact lists, handwritten orders and logs. The term is most common in healthcare, where staff keep paper charts and quick-start cards for when the electronic health record goes down. Any organization that depends on a few systems needs an equivalent for orders, payroll and customer contact, and people need to have practised it.

See also: Business continuity plan (BCP), Critical business functions, Ransomware Sources: files.asprtracie.hhs.gov, asprtracie.hhs.gov, ready.gov

A supervised, hands-on activity that tests one specific function, such as restoring a single system from backup or calling everyone on the after-hours contact list. It's narrow by design, so the result is easy to measure. Drills suit the technical steps that a tabletop only talks about.

See also: Operations-based exercise, Incident response drill, Tabletop exercise (TTX) Sources: emilms.fema.gov, fema.gov

The number of days an attacker is inside a network before anyone detects them. The longer it runs, the more systems, accounts and data they can touch, and the harder it is to say what was taken. Mandiant's M-Trends 2026 report gives a global median of 14 days for 2025. For example: forensics finds the first login seven weeks before the ransom note, and "what did they see in that time?" becomes the central question.

Read the full entry →

See also: Mean time to detect (MTTD), Initial access, Digital forensics Sources: cloud.google.com, services.google.com

A plan for the first minutes of a physical emergency such as a fire, severe weather, a threat on site or a medical event: who raises the alarm, who evacuates or shelters people and who calls emergency services. Ready.gov describes it as the documented approach to protect people, limit damage and support recovery. It is separate from a cyber incident response plan, though a cyber event with physical effects can trigger both.

See also: Crisis management plan, Incident response plan, Business continuity plan (BCP) Sources: ready.gov

Eradication is removing the cause of an incident from the environment: deleting malware, closing the attacker's accounts and access, patching the weakness they used and rebuilding systems that can't be trusted. It follows containment and comes before full recovery. Declaring it done too early, before the entry point is fixed, is how organizations get hit a second time by the same intruder.

See also: Containment, Recovery (incident response), Root cause analysis Sources: cyber.gc.ca, cyber.gc.ca

Evidence preservation means keeping logs, devices, accounts and messages intact so they can be analyzed later. During an incident that means resisting the urge to wipe and reimage machines right away, extending log retention before old logs roll off, and recording who touched what. It competes with fast recovery, so decide early, with legal advice, what you'll keep.

See also: Chain of custody, Forensic image, Legal hold Sources: cyber.gc.ca

The person who runs an exercise as it unfolds. Controllers release injects, set the pace, keep play inside the planned boundaries and, in many exercises, answer questions in the role of outside parties such as a regulator or vendor. In a small tabletop, the facilitator often does this job too.

See also: Facilitator, Inject, Simulation cell (SimCell) and white cell Sources: fema.gov

A form that ties each exercise objective to the activities evaluators should look for, with room to record what actually happened. It gives evaluators one consistent way to judge performance against the plan instead of relying on memory afterward. The notes feed the after-action report. A worked example is on the exercise evaluation guide page.

See also: Exercise evaluator, After-action report (AAR), SMART objectives Sources: fema.gov

A person chosen for relevant expertise to observe an exercise, record what people do and compare it with the plan, policies and procedures. Evaluators don't prompt or coach the players. Their notes on who decided what, when and why are the raw material for the after-action report.

See also: Exercise evaluation guide (EEG), After-action report (AAR), Facilitator Sources: fema.gov, cisa.gov

A document that gives participants general information about an exercise, including its objectives and scope. HSEEP uses it mainly for operations-based exercises, alongside a controller and evaluator handbook that holds the detail players shouldn't see in advance. It answers the practical questions: what's being tested, what's out of bounds, and who to call if something real happens.

See also: Situation manual (SitMan), Controller and evaluator handbook, Operations-based exercise Sources: fema.gov

The person who leads a discussion-based exercise. They present the scenario, ask the questions, watch the clock and keep the group on the stated objectives. A good one draws decisions out of the room instead of answering for it, and asks "who owns that?" more often than "what should you do?"

See also: Tabletop exercise (TTX), Exercise controller, Exercise evaluator Sources: fema.gov, cisa.gov

Failover is switching operations from a failed or compromised primary system to a standby or recovery system, automatically or by hand. Failback is the planned return to the primary system once it has been restored and cleared. Failback is often the riskier step: changes made on the recovery system must be synchronized, and the primary must be confirmed clean first. Both should be tested before they are needed.

See also: Disaster recovery testing, Hot site, warm site and cold site, Disaster recovery plan Sources: csrc.nist.gov, rubrik.com, commvault.com

First-party coverage pays the insured's own losses from an incident, such as forensics, notification, data restoration and lost income. Third-party coverage responds when others make claims against the insured, for example customers suing after a breach or a regulatory proceeding, and typically pays defence costs and settlements. Cyber policies often combine both, but each part has its own limit, retention and conditions, so read them separately.

See also: Cyber insurance, Sublimit, Retention (cyber insurance) Sources: unitedingratitude.aon.com, insurancebusinessmag.com

A forensic image is an exact, bit-for-bit copy of a disk or other storage, including free space and slack space where deleted data can survive. Investigators analyze the copy and leave the original untouched. Rebuilding a machine to get it back into service before taking an image destroys evidence you may need later.

See also: Digital forensics, Chain of custody, Evidence preservation Sources: csrc.nist.gov

A US Federal Trade Commission rule (16 CFR Part 314) requiring non-bank financial institutions, such as mortgage lenders, payday lenders and tax preparers, to run a written information security program. It requires a designated Qualified Individual and a written incident response plan, though institutions holding information on fewer than 5,000 consumers are exempt from some parts. The FTC must be told within 30 days of discovering an unauthorized acquisition of unencrypted customer information affecting 500 or more consumers.

See also: Incident response plan, Board oversight of cyber risk, vCISO Sources: ecfr.gov, ftc.gov

The most complex and resource-intensive type in the HSEEP framework. It involves several organizations, runs in real time and tries to mirror a real incident as closely as planners can. It takes heavy planning and many people, so a mid-size organization is more likely to join one run by a sector group or government body than to run its own.

See also: Operations-based exercise, Functional exercise, Drill Sources: emilms.fema.gov, fema.gov

An operations-based exercise that tests how a team manages and coordinates a response in real time. People do the actual work, such as opening the incident channel, assigning roles and sending updates, while the incident itself is simulated. It goes further than a tabletop, because it shows whether the process holds up at speed and not only whether people know it.

See also: Operations-based exercise, Tabletop exercise (TTX), Drill Sources: emilms.fema.gov, fema.gov

Coverage for money lost when a fraudster causes funds to leave the insured's accounts, often through a spoofed email, altered payment instructions or a compromised account. It overlaps with social engineering coverage but focuses on the outcome, the fraudulent transfer, not the method. It often carries its own sublimit. Wordings and triggers vary, so check how it interacts with any separate crime policy.

See also: Social engineering fraud coverage, Business email compromise (BEC), Sublimit Sources: coalitioninc.com

In an exercise, the facts of the scenario as designed: what the fictional attackers did, when, and what the systems would actually show. The facilitator or controller holds it, while players see only what the injects reveal. It lets the facilitator answer "was data taken?" consistently. HSEEP includes a ground truth advisor role for keeping scenario details consistent.

See also: Inject, Facilitator, Master scenario events list (MSEL) Sources: fema.gov

The US rule (45 CFR 164.400 to 164.414) requiring HIPAA covered entities to notify affected individuals and HHS after a breach of unsecured protected health information, and business associates to notify the covered entity. Notice is due without unreasonable delay and no later than 60 days after discovery. Breaches affecting more than 500 residents of a state also require media notice. An impermissible use or disclosure is presumed to be a breach unless a risk assessment shows a low probability of compromise.

See also: Data breach, PHIPA, Privacy breach Sources: hhs.gov, ecfr.gov

A holding statement is a short, pre-approved public message issued early in an incident, before the facts are known. It acknowledges the problem, says what is being done and promises an update, without guessing at cause or scope. It buys time, but it isn't a breach notification and it goes stale quickly. Example: "We are aware of a disruption to some of our systems and are working with specialists to understand it."

Read the full entry →

See also: Crisis communications, Spokesperson, Out-of-band communication Sources: ncsc.govt.nz, high-profile.com

These are three kinds of alternate location for restoring operations. A hot site is fully equipped and ready to take over, a warm site is partly equipped, and a cold site is little more than space and power. The shorter your recovery time objective, the hotter the arrangement needs to be, and the more it costs. Cloud recovery options now fill the same roles.

Read the full entry →

See also: Recovery time objective (RTO), Disaster recovery plan, Failover and failback Sources: csrc.nist.gov, csrc.nist.gov, csrc.nist.gov

A short, facilitated debrief held right after an exercise, or after a real incident, while people still remember what happened. Participants say what worked, what didn't and what to change, and the notes feed the after-action report. It's quick and informal. It works best when someone writes down each point with an owner before everyone leaves the room.

Read the full entry →

See also: After-action report (AAR), Improvement plan, After-action review Sources: fema.gov

The US Federal Emergency Management Agency's doctrine for planning, running, evaluating and following up on exercises. Much of the vocabulary tabletop facilitators use, including hotwash, inject and after-action report, comes from it. It's US guidance, not a Canadian standard, so a Canadian organization can use it as a model without treating it as a requirement.

Read the full entry →

See also: Tabletop exercise (TTX), Discussion-based exercise, Improvement plan Sources: fema.gov

A backup that can be read but not changed or deleted until a set retention period ends, usually on write-once storage. In the meantime even an attacker with administrator access cannot encrypt or erase it. Immutability is different from an air gap, which is about network reachability. Protection lasts only as long as the retention period, which should outlast the time an attacker might go unnoticed. Restores still need testing.

See also: Air-gapped backup, 3-2-1 backup rule, Ransomware Sources: ibm.com, docs.aws.amazon.com, cisa.gov

The part of an after-action report that turns findings into work. In HSEEP's AAR/IP format, each corrective action gets an owner and a due date, and someone tracks it to completion. Without that step, an exercise produces a list of observations and no change. The first question at the next exercise should be which items from the last one were closed.

See also: After-action report (AAR), Corrective action, Lessons learned Sources: fema.gov

The one person who coordinates the response to a cyber incident and has the authority to make, or quickly tee up, decisions until it ends. The title comes from the Incident Command System used in emergency management. Some organizations call the role incident lead or incident manager. The plan should name it by position, with alternates, because a common early failure is several people steering at once, or nobody.

Read the full entry →

See also: Incident response team, Crisis management team, Decision log Sources: emilms.fema.gov, nvlpubs.nist.gov

An incident handler is the person who does the hands-on work of a specific incident: gathering facts, judging scope, coordinating containment and keeping the record. In larger organizations it's a security analyst or responder. In smaller ones it may be an IT manager or an outside firm. The role is distinct from the incident commander, who runs the overall response and makes the calls.

See also: Incident commander, Incident response team, Incident triage Sources: csrc.nist.gov

Incident response is the organized process of detecting, analyzing, containing and recovering from a security incident, then learning from it. NIST's current guidance, SP 800-61 Rev. 3, ties it to the Detect, Respond and Recover functions of Cybersecurity Framework 2.0, supported by preparation. None of it works unless roles, authority and contact lists are settled before something goes wrong.

See also: Incident response plan, Incident response team, NIST SP 800-61 Sources: csrc.nist.gov, nvlpubs.nist.gov

A short, hands-on practice of one response task, such as isolating a compromised laptop, restoring a file from backup or reaching everyone on the after-hours contact list. It checks that a step works and how long it takes. A tabletop discusses the whole response and often comes first: it finds the weak step, and the drill proves the fix.

See also: Drill, Tabletop exercise (TTX), Incident response plan Sources: emilms.fema.gov, fema.gov

The insurer's pre-approved list of breach lawyers, forensic investigators, notification and credit monitoring providers and communications firms. Policies typically cover response costs when you use panel vendors, and may limit or refuse payment if you hire others without the insurer's consent. Look at the panel before an incident, and ask whether a provider you already use can be approved.

See also: Panel counsel, Breach coach, Incident response retainer Sources: northbridgeinsurance.ca, haynesboone.com, insurancebusinessmag.com

An incident response plan is the written document that sets out how an organization will handle a security incident: who's on the team, who decides what, how incidents are rated and who gets called. NIST's glossary describes it as predetermined instructions to detect, respond to and limit the consequences of a malicious attack. Cyber insurers commonly ask whether yours has been tested. Our incident response plan template shows a typical structure.

See also: Incident response policy, Incident response playbook, Tabletop exercise (TTX) Sources: csrc.nist.gov, cyber.gc.ca

An incident response playbook is a scenario-specific set of steps for a type of incident, such as ransomware, business email compromise or a lost laptop. Where the plan sets the structure, the playbook says what to do first, who does it and which decisions come up. The Canadian Centre for Cyber Security notes that a guide for every possible incident isn't realistic, so write them for the incidents you're most likely to face.

See also: Incident response plan, Runbook, Incident triage Sources: cyber.gc.ca, nvlpubs.nist.gov

An incident response policy is the short, high-level document in which management commits to responding to security incidents. NIST says it should state purpose, scope, definitions, roles, how incidents are prioritized and how performance is measured. It sets the rules and the authority. The plan and playbooks carry the steps. A starting point is our incident response policy template.

See also: Incident response plan, Incident response playbook, NIST SP 800-61 Sources: nvlpubs.nist.gov

An incident response retainer is a standing agreement with an outside firm that can investigate and help contain an incident, so you aren't shopping for help during one. It usually sets how fast the firm responds and what work it covers. Check how it fits with your cyber insurance, since many policies expect you to use the insurer's approved responders.

See also: Incident response panel (insurer), Panel counsel, Cyber insurance Sources: cyber.gc.ca

The incident response team is the group assigned to handle security incidents. Canadian Centre for Cyber Security guidance calls for a cross-functional team, with IT and security staff joined by legal, management and others, and a backup contact for each member. An out-of-date team list can cost you the first hour of a real incident, so check names and numbers regularly.

See also: CSIRT and CIRT, Incident commander, Crisis management team Sources: cyber.gc.ca, cyber.gc.ca

Incident severity levels are the scale an organization uses to rate how serious an incident is, often from low to high or 1 to 4. Each level should trigger set actions: who is told, how fast and who leads. Criteria usually weigh business impact, the type of data involved and whether operations are down. No single scale is standard, so each organization defines its own.

See also: Incident triage, Incident response plan, Crisis management team Sources: nvlpubs.nist.gov, cyber.gc.ca

Incident triage is the first quick sort of an alert or report: is this real, how bad could it be, and who needs to look at it now? It assigns a severity and an owner so urgent items don't wait behind routine ones. Triage is done on partial facts, so the process should let the rating be raised or lowered later without argument.

See also: Incident severity levels, Security event vs security incident, Security operations centre (SOC) Sources: nvlpubs.nist.gov, cyber.gc.ca

Indicators of attack are signs of attacker behaviour as it happens, rather than traces left behind. Examples: an account running commands it never runs, a tool pulling passwords from memory, a new administrator account created at 3 a.m. They can catch an attack even when the malware or address is new. Indicators of compromise show what the attacker left. Indicators of attack show what they're doing.

See also: Indicators of compromise (IOCs), Tactics, techniques and procedures (TTPs), Threat actor Sources: csrc.nist.gov, attack.mitre.org

Indicators of compromise are technical clues that a system is, or has been, under attack: a malicious file's fingerprint, an address or domain the attacker used, an unusual login, a strange scheduled task. NIST describes them as observables showing an attack is coming, underway or that a compromise may already have happened. Responders search logs and devices for them to scope an incident. They go stale fast, because attackers change infrastructure.

See also: Indicators of attack (IOAs), Command and control (C2), Dwell time Sources: csrc.nist.gov

Initial access is where an attacker first gets into your network. MITRE ATT&CK, a widely used catalogue of attacker behaviour, lists it as a tactic. Common routes: phishing, stolen credentials, an exploited internet-facing system, a compromised supplier. When and how it happened decides how far back responders look and which logs have to be kept.

See also: Attack vector, Lateral movement, Initial access broker Sources: attack.mitre.org

A criminal who gains a foothold in a company's network, through stolen passwords or exposed remote access, and sells that access to others, often ransomware groups. The Cyber Centre notes this speeds their attacks. The practical point is that the party who sold the access and the one who encrypts may differ, so resetting one password doesn't prove the intruders are out.

See also: Ransomware as a service (RaaS), Initial access, Account takeover Sources: cyber.gc.ca

New information the facilitator introduces partway through an exercise (nothing to do with code injection) to move the scenario along and force a decision, such as a call from a reporter or a message from the attacker. HSEEP treats it as an event that the control staff introduces to players. For example: "At 2 p.m., the help desk reports that finance can't open files." Good injects give some detail, not the answer.

Read the full entry →

See also: Master scenario events list (MSEL), Facilitator, Trusted agent Sources: fema.gov

The risk that someone with authorized access, such as an employee, contractor or partner, will cause harm, on purpose or by accident. NIST's definition covers both witting and unwitting harm. In a tabletop it forces a different set of decisions than an outside attack, because HR and legal need to be involved before IT acts on a named person.

See also: Data exfiltration, Evidence preservation, Legal hold Sources: csrc.nist.gov

Fraud in which a criminal sends a fake invoice, or a message saying a supplier's bank details have changed, so a legitimate payment lands in an account the criminal controls. The Canadian Anti-Fraud Centre advises confirming any change in payment details by phone. In a tabletop, ask who is allowed to change vendor banking details, and who checks.

See also: Business email compromise (BEC), Vendor email compromise, Funds transfer fraud coverage Sources: antifraudcentre-centreantifraude.ca

ISO/IEC 27001 is the international standard for an information security management system. In its 2022 edition, Annex A includes five incident controls numbered 5.24 to 5.28: incident management planning and preparation, assessing and deciding on events, responding to incidents, learning from incidents and collecting evidence. Auditors typically want records showing the process was followed, not just a policy that describes it.

See also: ISO/IEC 27035, Incident response plan, SOC 2 CC7 Sources: urmconsulting.com

ISO/IEC 27035 is an international series of standards on information security incident management. Part 1 (2023) sets out principles and process: preparing for, detecting, reporting, assessing and responding to incidents, then applying lessons learned. Part 2 covers planning and preparation, and Part 3 covers response operations. It's a paid standard, so read it through ISO or a national standards body before citing it.

See also: NIST SP 800-61, ISO/IEC 27001 incident controls, Incident response plan Sources: iso.org, iso.org, iso.org

Lateral movement is how an attacker spreads from the first compromised machine to others, using stolen credentials and ordinary admin tools to reach servers, backups and data. MITRE describes it as the adversary moving through your environment. It's what turns one infected laptop into an organization-wide incident, which is why network segmentation and quick credential resets matter during containment.

See also: Privilege escalation, Initial access, Containment Sources: attack.mitre.org

A legal hold is a formal instruction to preserve information that may matter to a lawsuit, investigation or claim, and to suspend normal deletion. The duty starts when litigation is reasonably anticipated, which a serious breach often triggers. In an incident it means keeping logs, mailboxes and forensic images, and not rebuilding systems before evidence is captured. The US calls it a litigation hold, while Canadian law frames it as the duty to preserve evidence.

Read the full entry →

See also: Evidence preservation, Chain of custody, Forensic image Sources: thesedonaconference.org, law.cornell.edu, scc-csc.ca

The takeaways from an exercise or incident that an organization commits to act on. An observation only becomes a lesson learned once something changes: a plan is rewritten, a contact is added, a person is trained. Otherwise the same finding tends to come back at the next exercise, or in a real incident.

See also: After-action report (AAR), Corrective action, Improvement plan Sources: fema.gov, appel.nasa.gov

The timed script of an exercise: a chronological list of the events to introduce, who delivers each and the response expected. HSEEP describes it as a timeline of expected actions and scripted events injected by controllers. Players don't see it, and it ties each inject to an objective and often holds contingency injects for when the discussion stalls. In a small tabletop it may be a one-page run sheet.

Read the full entry →

See also: Inject, Situation manual (SitMan), Ground truth Sources: fema.gov

The longest a business process can be disrupted before the harm to the organization becomes unacceptable. NIST defines it as the time a process can be disrupted without significant harm to the mission, and some frameworks call it MTPD. It is the outer limit that recovery time objectives must sit inside. For example, if order processing can be down for two days at most, the RTO for its systems has to be shorter.

See also: Recovery time objective (RTO), Recovery point objective (RPO), Business impact analysis (BIA) Sources: csrc.nist.gov, csrc.nist.gov

Mean time to detect is the average time between an incident starting, or an attacker getting in, and the organization noticing it. Lower is better, but the start time is often only known after the investigation, and an average can hide a few very long cases. Use it to track a trend, and write down how the clock starts.

See also: Mean time to respond (MTTR), Dwell time, Security operations centre (SOC) Sources: nvlpubs.nist.gov

Mean time to respond is the average time from detecting an incident to taking a defined response action, such as containing it. The same letters are also used for mean time to recover, resolve and repair, so state which you mean and when the clock starts and stops before comparing numbers across teams or vendors. Executives should ask which one a report is using.

See also: Mean time to detect (MTTD), Recovery (incident response), Recovery time objective (RTO) Sources: nvlpubs.nist.gov

An attack in which someone with a stolen password triggers repeated MFA approval prompts until the user taps accept to make them stop. It's also called push bombing. CISA notes that phishing-resistant MFA, such as FIDO or WebAuthn, isn't open to it. In a tabletop, ask what an employee should do after unexpected prompts, and whether they'd report having approved one.

See also: Account takeover, Credential stuffing, SIM swap Sources: cisa.gov

Version 2.0 of the NIST Cybersecurity Framework, published in February 2024. It describes cybersecurity outcomes in six functions: Govern, Identify, Protect, Detect, Respond and Recover. Respond covers action once an incident is detected, and Recover covers restoring operations and keeping stakeholders informed. Organizations may adopt it voluntarily, and customers and assessors often use it as a common way to describe a security program.

See also: NIST SP 800-61, Cyber resilience, Incident response plan Sources: csrc.nist.gov, nvlpubs.nist.gov

NIST Special Publication 800-61 is the US National Institute of Standards and Technology's guidance on incident response. The current version, Revision 3, was published in April 2025 and replaced Revision 2 from 2012. It recasts incident response around the six functions of Cybersecurity Framework 2.0 instead of the older four-phase cycle, and it's a common reference when writing or reviewing a plan.

See also: Incident response, NIST CSF 2.0, NIST SP 800-84 Sources: csrc.nist.gov, nvlpubs.nist.gov

NIST Special Publication 800-84 is a guide to designing, developing, conducting and evaluating test, training and exercise programs for IT plans and capabilities. It covers exercises including tabletops and is a common reference for how to structure them. It was published in 2006, and NIST's page lists no later revision, so pair it with newer exercise guidance such as HSEEP.

See also: NIST SP 800-61, Tabletop exercise (TTX), HSEEP (Homeland Security Exercise and Evaluation Program) Sources: csrc.nist.gov

An exercise run without advance warning to most participants. Only a small group knows it's coming, as with unannounced red team activity. It shows how people react when they haven't prepared, but it carries risk: every message must be clearly labelled as an exercise, so nobody alerts a customer or regulator by mistake. Most tabletops are announced.

See also: Red team exercise, Incident response drill, Drill Sources: csrc.nist.gov

The federal privacy regulator, led by an Agent of Parliament. It oversees PIPEDA for private-sector organizations and the Privacy Act for federal institutions. Organizations report breaches of security safeguards that pose a real risk of significant harm to the OPC, which can also investigate complaints. Alberta, British Columbia and Quebec have their own private-sector laws and regulators, which generally apply to activity within those provinces.

See also: PIPEDA, Real risk of significant harm (RROSH), Breach of Security Safeguards Regulations Sources: priv.gc.ca, priv.gc.ca, laws-lois.justice.gc.ca

An organization's ability to keep delivering its critical operations through disruption, whatever the cause: a cyber attack, a supplier failure, an outage, a pandemic. It treats disruption as expected and looks at services from end to end, including dependencies and how much interruption can be tolerated. OSFI and the Basel Committee use the term for financial institutions, and the idea applies to any organization.

See also: Cyber resilience, OSFI Guideline E-21, Business continuity management Sources: osfi-bsif.gc.ca, bis.org

In HSEEP, an exercise where people react to a scenario by doing the work: mobilizing staff, sending communications, using systems. Drills, functional exercises and full-scale exercises are the three types. They show whether a plan works in practice, and they take more planning and effort than discussion-based exercises.

See also: Discussion-based exercise, Drill, Functional exercise Sources: emilms.fema.gov, fema.gov

OSFI's guideline on technology and cyber risk management for federally regulated financial institutions, effective 1 January 2024. It is principles-based and has three domains: governance and risk management, technology operations and resilience, and cyber security. Topics include incident management, disaster recovery and recovering and learning from cyber incidents. It is a guideline rather than a statute, and OSFI expects it to be applied on a risk basis.

See also: OSFI Guideline E-21, Operational resilience, NIST CSF 2.0 Sources: osfi-bsif.gc.ca, osfi-bsif.gc.ca

OSFI's guideline on operational risk management and operational resilience for federally regulated financial institutions, issued in 2024. It expects institutions to identify critical operations, map their internal and external dependencies, set tolerances for disruption and test against severe but plausible scenarios. OSFI set 1 September 2026 for full adherence and 1 September 2027 for completing scenario testing of all critical operations.

See also: Operational resilience, Critical business functions, OSFI Guideline B-13 Sources: osfi-bsif.gc.ca, osfi-bsif.gc.ca

Out-of-band communication means using a separate channel from the one normally used, so that a problem with the main one doesn't cut you off. In an incident it means reaching the team by personal phones, a messaging group set up in advance or a separate email account, because company email and chat may be down or watched by the attacker. The Cyber Centre's ransomware playbook advises this.

See also: Call tree, War room, Crisis communications Sources: csrc.nist.gov, cyber.gc.ca

A law firm the cyber insurer has pre-approved to advise on incidents, often called the breach coach. The firm usually directs early response: assessing legal and notification duties, bringing in forensic investigators and advising on regulator contact. Using panel counsel typically keeps costs within coverage, and running the investigation through counsel also supports privilege. Calling the insurer's claims line first is usually the right opening step.

See also: Breach coach, Incident response panel (insurer), Attorney-client privilege in incident response Sources: northbridgeinsurance.ca, haynesboone.com, mccarthy.ca

Ontario's Personal Health Information Protection Act, 2004. It governs how health information custodians, such as hospitals, clinics and pharmacies, collect, use, disclose and protect personal health information. After a breach, a custodian must notify affected individuals promptly and report to the Information and Privacy Commissioner of Ontario in the situations listed in the regulation, which include theft through ransomware or malware, unauthorized use or disclosure, and significant breaches.

See also: PIPEDA, HIPAA Breach Notification Rule, Privacy breach Sources: ipc.on.ca, ipc.on.ca, ontario.ca

Canada's federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act. It applies to organizations that handle personal information in the course of commercial activity. Since November 2018 it has required them to report breaches of security safeguards that pose a real risk of significant harm to the Privacy Commissioner, notify affected individuals and keep a record of every breach. Quebec, British Columbia and Alberta have their own laws.

See also: Real risk of significant harm (RROSH), Breach of Security Safeguards Regulations, Office of the Privacy Commissioner of Canada (OPC) Sources: laws-lois.justice.gc.ca, laws-lois.justice.gc.ca, priv.gc.ca

A post-incident review is a structured meeting and written follow-up after an incident is closed, covering what happened, what worked and what didn't. It should end with a short list of changes, each with an owner and a date: plan updates, new controls, training. NIST Rev. 3 recommends an after-action report covering the incident, the response and recovery actions, and lessons learned. Keep it about fixing process, not blaming people.

See also: After-action report (AAR), Lessons learned, Root cause analysis Sources: nvlpubs.nist.gov, cyber.gc.ca

A privacy breach is the loss of, or unauthorized access to or disclosure of, personal information. It's narrower than a data breach, which can involve any data. Under PIPEDA, a breach of security safeguards must be reported to the Privacy Commissioner and to affected individuals when it creates a real risk of significant harm, and every breach must be recorded for 24 months. Some provinces have their own laws.

See also: Data breach, Real risk of significant harm (RROSH), PIPEDA Sources: priv.gc.ca, laws-lois.justice.gc.ca, laws-lois.justice.gc.ca

Privilege escalation is an attacker gaining higher-level permissions than they started with, such as moving from an ordinary user account to an administrator. It lets them turn off security tools, reach backups and push ransomware across many machines. An ordinary account suddenly added to an admin group is a typical warning sign. Resetting privileged credentials is an early step in many responses.

See also: Lateral movement, Initial access, Command and control (C2) Sources: attack.mitre.org

A formal statement a policyholder submits to support a claim, setting out what was lost and how much. In a cyber claim it usually means documented response and recovery costs and, for business interruption, income records and often a forensic accountant's calculation. Policies commonly set a deadline, so start collecting invoices, timelines and decision records during the incident, not months later.

See also: Business interruption coverage, Waiting period (business interruption), Decision log Sources: irmi.com, crcgroup.com

A collaborative test in which attackers (the red team) and defenders (the blue team) work openly together. The red team runs a technique, the blue team checks whether it was seen, and they tune detection on the spot. It's a technical exercise aimed at security tooling, and it complements a tabletop, which tests leadership decisions.

See also: Red team exercise, Breach and attack simulation (BAS), Cyber range Sources: csrc.nist.gov

The 2021 Quebec statute, formerly Bill 64, that modernized the province's privacy laws, including the Act respecting the protection of personal information in the private sector. Its measures were phased in from September 2022. They include mandatory reporting of confidentiality incidents, a person in charge of personal information and privacy impact assessments for certain projects. The Commission d'accès à l'information can impose administrative penalties of up to $10 million or, if greater, 2% of worldwide turnover.

See also: Confidentiality incident (Quebec), PIPEDA, Privacy breach Sources: assnat.qc.ca, legisquebec.gouv.qc.ca, blakes.com

Malware that encrypts a victim's files so systems stop working, followed by a demand for payment in exchange for the key. Many attackers also steal data first. In a tabletop it forces the early decisions: who can order systems offline, when to call the insurer and counsel, and how the business runs without its systems. See the ransomware recovery plan guide.

See also: Double extortion, Ransomware as a service (RaaS), Wiper malware Sources: cisa.gov, cyber.gc.ca

A criminal business model in which developers build and maintain ransomware, then lease it to affiliates who carry out the attacks and share the proceeds. It lowers the skill needed to run an attack, so the person inside your network may not be the person who wrote the malware. Responders still want to know who is behind it, because that shapes legal advice and what happens next.

See also: Ransomware, Initial access broker, Threat actor Sources: cyber.gc.ca

The PIPEDA threshold for reporting a breach of security safeguards to the Privacy Commissioner and notifying affected individuals. Significant harm includes humiliation, damage to reputation, financial loss, identity theft and damage to credit records. The factors are the sensitivity of the information and the probability it has been, is being or will be misused. Document the assessment and its reasons, because every breach must be recorded, reportable or not.

See also: PIPEDA, Breach of Security Safeguards Regulations, Privacy breach Sources: laws-lois.justice.gc.ca

Recovery is restoring systems and data to normal operation after the threat has been removed, and confirming they're safe to use. The Cyber Centre's guidance says to remove malware before restoring from backups, bring back critical systems first, and test and monitor before returning them to service. How long that takes ties to business continuity targets. See our ransomware recovery plan.

See also: Containment, Eradication, Business continuity plan (BCP) Sources: cyber.gc.ca, cyber.gc.ca

A recovery point objective is how much recent data, measured in time, an organization can afford to lose. It decides how often data must be backed up or replicated: a nightly backup supports an RPO of about a day, not an hour. Example: if the last clean backup is from 2 a.m. and ransomware hits at 3 p.m., that day's work is gone.

Read the full entry →

See also: Recovery time objective (RTO), Immutable backup, Business impact analysis (BIA) Sources: csrc.nist.gov, docs.aws.amazon.com

A recovery time objective is the target length of time a system or process can be down before the harm becomes unacceptable. It sets the order and urgency of restoration in an incident. It has to be shorter than the maximum tolerable downtime, and it only means something if it covers everything between the outage and a working service, not just the restore job.

Read the full entry →

See also: Recovery point objective (RPO), Maximum tolerable downtime (MTD), Hot site, warm site and cold site Sources: csrc.nist.gov, csrc.nist.gov

A test in which authorized people, the red team, act as a real adversary and try to break into an organization using realistic methods. NIST describes it as a simulated adversarial attempt that reflects real-world conditions. It tests defences and detection on live systems, so it answers a different question than a tabletop, which tests the decisions people make once something is found.

See also: Purple team exercise, Tabletop exercise (TTX), No-notice exercise Sources: csrc.nist.gov, csrc.nist.gov

The amount the insured pays before the insurer's coverage responds, much like a deductible. With a self-insured retention the insured pays first and the insurer pays once the retention is used up; with a deductible the insurer typically pays and then recovers the amount. Cyber policies may apply different retentions to different coverages, so check which applies to forensics, business interruption and extortion.

See also: Sublimit, Waiting period (business interruption), First-party and third-party cyber coverage Sources: irmi.com, help.coalitioninc.com

The date before which a claims-made policy typically will not cover incidents, even if the claim is made during the policy period. It is often tied to when coverage with that insurer first began, so switching insurers can leave a gap unless prior acts coverage is arranged. That matters for problems that started earlier, such as an intrusion that sat undetected for months.

See also: Claims-made policy, Dwell time, Underwriting (cyber insurance) Sources: unitedingratitude.aon.com, reedsmith.com, insurancebusinessmag.com

A documented decision by someone with the authority to live with a known risk instead of reducing, transferring or avoiding it. A useful record names the risk, the reason, who accepted it, a review date and any compensating controls. Accepted risks stay in the risk register. A gap that nobody has recorded or approved is not an accepted risk. It is just an unmanaged one.

See also: Risk register, Cyber risk appetite, Board oversight of cyber risk Sources: csrc.nist.gov

A central record of identified risks and related information: a description, an owner, likelihood and impact, existing controls, planned treatment and status. NIST describes it as a central record of current risks for a given scope, covering both accepted risks and those with a planned path to mitigation. It is only useful if someone owns each entry and reviews it on a schedule.

See also: Risk acceptance, Cyber risk appetite, Board oversight of cyber risk Sources: csrc.nist.gov

Root cause analysis is finding why an incident happened, not just what happened. NIST describes it as a systems approach to identifying the underlying causes of a set of risks. Example: a stolen password is how the attacker got in, but the missing second factor and the lack of login alerts are the root causes. A PIPEDA breach report to the Privacy Commissioner must give the cause if it's known.

See also: Post-incident review, Eradication, Attack vector Sources: csrc.nist.gov, laws-lois.justice.gc.ca

A runbook is a step-by-step technical procedure for one task, such as isolating a host, resetting a set of credentials or restoring a database from backup. It's narrower than a playbook, which covers a whole scenario and its decisions. A good runbook lets someone follow it at 2 a.m. without guessing, and it should be tested before it's needed, since steps that look fine on paper often don't work in practice.

See also: Incident response playbook, Incident response plan, Incident handler Sources: nvlpubs.nist.gov

For US public companies, Form 8-K Item 1.05 requires disclosure of a cybersecurity incident the company determines to be material. The filing is due within four business days of that determination, which must be made without unreasonable delay, and describes the incident's nature, scope, timing and impact. The US Attorney General can authorize a delay for national security or public safety. Annual reports must also describe cyber risk management and board oversight.

See also: Board oversight of cyber risk, Data breach, Incident severity levels Sources: sec.gov, sec.gov, sec.gov

A security event is any observable occurrence involving computing assets, such as a failed login or a firewall alert. A security incident is narrower: under NIST's definition, an occurrence that actually or imminently jeopardizes the confidentiality, integrity or availability of information or systems, or violates law or security policy. Most events are routine. The moment one becomes an incident can trigger obligations, such as notifying your insurer or counsel.

See also: Incident triage, Incident severity levels, Data breach Sources: nvlpubs.nist.gov, csrc.nist.gov

A security incident report is the written record of one incident: what was detected and when, which systems and data were affected, what was done, who was told and how it ended. It's started during the incident and finished after. Insurers, auditors and leadership rely on it, and in Canada it can feed the breach record that organizations must keep for 24 months. Our security incident report template shows a typical layout.

See also: Decision log, Post-incident review, Privacy breach Sources: laws-lois.justice.gc.ca, cyber.gc.ca

A security operations centre, or SOC, is the team, and often the room or managed service, that monitors an organization's systems for signs of attack and does the first response. Many mid-size organizations buy this from an outside provider rather than run their own. The SOC is usually where an incident is first noticed, so write down how it hands off to the response team.

See also: Incident triage, Security event vs security incident, Mean time to detect (MTTD) Sources: csrc.nist.gov

A list of questions about an organization's security practices, sent by an insurer, customer or partner to judge risk. Typical topics are multi-factor authentication, backups, patching, vendor management and whether the incident response plan is written and tested. Wording matters: "written", "tested" and "all" each narrow the answer. Answers can be checked after a loss, as a Canadian city's denied claim over multi-factor authentication showed.

See also: Cyber insurance application, Underwriting (cyber insurance), Incident response plan Sources: beazley.com, cowbell.insure, cbc.ca

An attack in which someone persuades a mobile carrier to move a victim's phone number to a SIM card they control, so calls and texts, including MFA codes, arrive on the attacker's phone. CISA describes attackers gathering personal details first to get past the carrier's checks. In a tabletop, an executive's phone suddenly loses service: which accounts rely on text codes, and who is told?

See also: Account takeover, MFA fatigue, Smishing Sources: cisa.gov

A simulation cell is the team that sends messages on behalf of organizations not taking part in the exercise, such as a regulator, insurer or customer. A white cell is the group that referees an exercise: it enforces ground rules, answers questions and keeps play on track. In small exercises, one person often plays both roles.

See also: Exercise controller, Inject, Red team exercise Sources: fema.gov, csrc.nist.gov

Any one component, person or supplier whose failure stops a critical function because nothing else can take over. Examples include a single internet link, one backup server, one payment processor or the one person who knows a password. Dependency mapping finds them. They also show up in response: if the incident lead is the only person who can restore a system, recovery stalls.

See also: Dependency mapping, Failover and failback, Critical business functions Sources: ready.gov

In HSEEP, the document that gives participants in a discussion-based exercise their background reading: the scenario, objectives, roles and discussion questions. HSEEP calls it the primary reference material for participants. In a tabletop it keeps everyone working from the same facts, so the discussion can start without a long setup.

See also: Tabletop exercise (TTX), Exercise plan (ExPlan), Facilitator Sources: fema.gov

Exercise objectives written to be specific, measurable, achievable, relevant and time-bound, as HSEEP recommends. A vague objective such as "test our response" can't be scored. A better one: by the end of the session, the group names who decides to take email offline and who tells the insurer.

See also: Exercise evaluation guide (EEG), Core capabilities, Tabletop exercise (TTX) Sources: fema.gov

Phishing by text message. The message usually carries a link to a fake login page, often on a lookalike domain, or asks the person to call a number or approve a sign-in. Texts land on phones outside company email filters, so defence depends on the employee noticing and reporting. A tabletop can ask how staff report one, and who watches that channel.

See also: Spear phishing, SIM swap, Vishing Sources: cyber.gc.ca, cisa.gov

CC7 is the System Operations group in the SOC 2 Trust Services Criteria, the AICPA framework used to audit service providers. Its five criteria are CC7.1 on detecting vulnerabilities, CC7.2 on monitoring for anomalies, CC7.3 on evaluating security events, CC7.4 on responding to incidents and CC7.5 on recovering from them. CC7.4 and CC7.5 bear most directly on incident response and recovery.

See also: ISO/IEC 27001 incident controls, NIST CSF 2.0, Incident response plan Sources: hicomply.com, aicpa-cima.com

Coverage for money an organization sends after being tricked by an impersonator, such as a fake vendor invoice or a spoofed instruction from an executive. It sometimes comes only by endorsement, can be narrow, and may carry its own sublimit. It can overlap with funds transfer fraud and crime insurance, so ask which policy responds first and what the retention is.

See also: Funds transfer fraud coverage, Business email compromise (BEC), CEO fraud Sources: coalitioninc.com, cira.ca

Phishing aimed at one person or a small group, using personal or role details to make the message believable. The Cyber Centre contrasts it with mass phishing. It often targets the people who can move money or reset access. In a tabletop, the useful question is what happens after someone clicks: who do they tell, and how soon do they dare to say so?

See also: Business email compromise (BEC), Vishing, Smishing Sources: cyber.gc.ca, cyber.gc.ca, antifraudcentre-centreantifraude.ca

The person authorized to speak for the organization during an incident, to media, customers and sometimes regulators. They are chosen and trained before a crisis, work from approved messages and keep statements consistent across channels. Everyone else refers questions to them. In a cyber incident the spokesperson works closely with counsel and the incident lead, so nothing is said that the facts do not yet support.

See also: Holding statement, Crisis communications, Incident commander Sources: readyrating.org, cyber.gc.ca

In the US, every state, the District of Columbia and several territories have their own law requiring notice to people whose personal information is breached. The laws differ on what counts as personal information, whether encrypted data is exempt, how quickly notice must go out and whether the state attorney general or another agency must be told. An incident affecting customers in several states usually calls for a state-by-state review by counsel.

See also: Data breach, Privacy breach, HIPAA Breach Notification Rule Sources: ncsl.org, ftc.gov

A cap on what a policy pays for one type of loss, set within the overall policy limit. It does not add coverage. Cyber policies may apply sublimits to items such as social engineering, funds transfer fraud and other specific losses, so a large headline limit can be much smaller for the loss you actually suffer.

See also: Retention (cyber insurance), Social engineering fraud coverage, Cyber insurance Sources: irmi.com, coalitioninc.com

An attack that reaches the target through a product or service it relies on, such as a compromised software update or a service provider. NIST defines it as an incident where an adversary exploits vulnerabilities in the target's product or service supply network. The decision it forces: when a vendor reports a compromise, how fast can you find where you use the product, and who decides what to switch off?

See also: Third-party breach, Dependency mapping, Vendor email compromise Sources: csrc.nist.gov

A discussion-based exercise in which a group talks through a realistic scenario and says what it would do at each step. Nobody touches a live system, and the point is to find gaps in the plan, the decisions and the handoffs before a real incident does. For example, a finance lead reports that a supplier's bank details changed yesterday and a large payment is due today: who stops it? See what a cybersecurity tabletop exercise is.

See also: Discussion-based exercise, Facilitator, Hotwash Sources: emilms.fema.gov, fema.gov

Tactics, techniques and procedures describe how an attacker behaves, at three levels of detail. NIST puts tactics as the highest-level description, techniques as more detail within a tactic, and procedures as the most specific. Example: the tactic is initial access, the technique is phishing and the procedure is one group's particular lure and attachment. Responders use TTPs to recognize a known group's pattern and to guess what comes next.

See also: Indicators of attack (IOAs), Threat actor, Initial access Sources: csrc.nist.gov, attack.mitre.org

A security incident at a vendor or partner that holds your data or connects to your systems. The failure is theirs, but the data and the customer relationships are yours. Depending on the law and your contract, you may still owe notices to customers or regulators. A tabletop checks whether you know which vendors hold what, and whom to call at each one.

See also: Supply chain attack, Dependency mapping, Data breach Sources: priv.gc.ca

A threat actor is, in NIST's short definition, an individual or group posing a threat. In practice it means whoever is behind an attack: a criminal gang, a state-backed group, an activist or an insider. Knowing which type you face shapes decisions about extortion, law enforcement and disclosure, but attribution is slow and uncertain during an incident, so don't build the response around a guess.

See also: Tactics, techniques and procedures (TTPs), Attack vector, Initial access broker Sources: csrc.nist.gov

Extortion that adds a third pressure to encryption and data theft, such as a DDoS attack or direct contact with the victim's customers, partners or staff. The Cyber Centre uses the broader term multi-extortion. It tests communications: who contacts customers first, so they hear it from you and not from the attacker.

See also: Double extortion, DDoS attack, Crisis communications Sources: cyber.gc.ca

A member of the exercise planning team who knows the scenario in advance and keeps it from the players. HSEEP notes that planning team members are typically not players, for that reason. Trusted agents supply local detail, such as real system names and vendors, so the scenario feels real. For example: the IT lead checks the injects for accuracy, then sits out the session so the discussion is a genuine test.

Read the full entry →

See also: Facilitator, Inject, Exercise controller Sources: fema.gov, vem.vermont.gov

The insurer's process of assessing an applicant's cyber risk and deciding whether to offer coverage, on what terms and at what price. It typically draws on the application, a security questionnaire and information about revenue and the data held. Controls such as multi-factor authentication and encryption are underwriting factors, and some insurers require them. Underwriters rely on the answers they are given.

See also: Cyber insurance application, Security questionnaire, Cyber risk quantification Sources: irmi.com, cira.ca, insurancebusinessmag.com

A virtual chief information security officer: an outside security leader, usually part time or on contract, who performs some or all of the CISO role for an organization without a full-time one. Typical work includes setting the security program, advising leadership and the board, managing risk and checking incident response readiness. Some rules permit the arrangement but keep accountability with the organization, including New York's financial regulation and the FTC Safeguards Rule.

See also: Board oversight of cyber risk, FTC Safeguards Rule, 23 NYCRR 500 Sources: dfs.ny.gov, ecfr.gov

A variation of BEC in which the attacker breaks into a real supplier's email account and sends invoices or payment changes from it. The message comes from the genuine address, often inside an existing thread, so filters and instinct both miss it. Staff need a check that doesn't rely on the email itself, such as a call to a number already on file.

See also: Business email compromise (BEC), Invoice fraud and payment diversion, Third-party breach Sources: antifraudcentre-centreantifraude.ca

Phishing by phone call or voicemail. Callers may spoof the number, pose as IT or a bank, or use AI to imitate a voice the target trusts. According to CISA, calls to a help desk asking for a password or MFA reset are a route to account takeover. A tabletop tests what the help desk must verify before it resets anyone's access.

See also: Spear phishing, Account takeover, Deepfake fraud Sources: cyber.gc.ca, cisa.gov

The period of downtime that must pass before business interruption coverage responds. Some policies pay nothing for losses inside the window; others pay from the start of the outage once the waiting period is exceeded. The length varies by policy, and it may also serve as the retention, so check how it is measured. A short outage can fall entirely inside it and produce no claim.

See also: Business interruption coverage, Retention (cyber insurance), Maximum tolerable downtime (MTD) Sources: crcgroup.com, corvusinsurance.com, help.coalitioninc.com

A step-by-step read-through of a plan with the people who own each step, checking that contacts, tools and instructions still match reality. There's no scenario and no time pressure. It's the lightest way to test a plan, and a sensible first step before a tabletop, because it catches stale phone numbers and missing owners cheaply.

See also: Tabletop exercise (TTX), Discussion-based exercise, Drill Sources: fdic.gov, ithandbook.ffiec.gov

A clause that removes losses caused by war or state-backed hostile action from coverage. Since 31 March 2023, Lloyd's has required the standalone cyber policies it writes to include a state-backed cyber-attack exclusion that defines key terms and sets out how an attack is attributed to a state. Wordings differ in reach, and how they apply to a state-linked ransomware attack can be uncertain. Read the exact clause and ask the broker how it applies.

See also: Cyber insurance, Ransomware, Threat actor Sources: assets.lloyds.com, insurancejournal.com, reedsmith.com

In incident response, a war room is the dedicated place, physical or virtual, where the response team and decision-makers work an incident together. It gives everyone one source for status, assignments and decisions. In an attack, chat tools on the affected network may be down or watched, so decide in advance where the war room will be and how people join it, including a channel outside company systems.

See also: Out-of-band communication, Crisis management team, Incident commander Sources: cyber.gc.ca, cyber.gc.ca

Malicious code built to destroy data, not to hold it for ransom. With destruction as the goal, there may be no key to buy, so recovery depends on clean backups and rebuilding systems. CISA treats destructive malware mainly as a threat to availability. A tabletop should ask how long a restore takes if restoring is the only route, and whether the backups are out of the attacker's reach.

See also: Ransomware, Immutable backup, Air-gapped backup Sources: cisa.gov

A vulnerability the software vendor doesn't yet know about or hasn't fixed, and an attack that exploits it. NIST describes a zero-day attack as one that exploits a previously unknown flaw. With no patch available, the response is about reducing exposure: what can be disabled, isolated or watched, and who decides to take a service offline while waiting for a fix.

See also: Supply chain attack, Initial access, Attack vector Sources: csrc.nist.gov, cyber.gc.ca