1. Overall IR plan summary: Purpose and coals Team (core and extended) Roles, Responsibilities, and Authorities Services, Processes, Procedures, and Playbooks Resources, facilities, Measures of success, KPIs 2. For each of the following six phases: Preparation (pre-incident] PP Detection & Analysis 3. Containment Eradication 5. RECOVERY Post-incident Activity The students will need to report the following: 1. Alim & goals of the phase High-level description of the phase 3. Process diagram of the phase 4. Tasking matrix (Task, team member, resource inputs, resource outputs) Detailed procedures for each process step Risk register and mitigations For instance if your group is writing about eradication phase then the group need to write about: (1) Aim & goals of the phase; (2) High- level description of the phase; (3) Process diagram of the phase: (4) Tasking matrix (Task, team member, resource inputs, resource out- puts]; (8) Detailed procedures for each process step ; and (6) Risk register and mitigations. Over all the report must cover the following toples: 1. Assemble an incident response team and allocate roles and responsibilities Plan responses to incidents according to prescribed processes 3. Defined in the organisation's incident response policy document Enterprise staff are selected to form an incident response team (IRT) Incident response team member's role and responsibilities are defined Communication strategies of the IIRT within the enterprise are clarified