Glossary
Playbook
A documented, scenario-specific set of steps, decisions and contacts that guides responders through a particular type of incident.
An incident-response playbook is a scenario-specific procedure that translates a general incident-response plan into concrete actions for one type of incident, such as ransomware, business email compromise, a leaked cloud credential or a DDoS attack.
A useful playbook typically covers: triggers and severity criteria, first actions, decision points and who owns them, containment options with their business impact, evidence to preserve, internal and external contacts (including insurer, legal counsel and providers), communication templates and notification considerations.
Playbooks differ from runbooks, which are usually narrower, step-by-step technical instructions for a specific task (for example, rotating a credential or isolating a host). A playbook often references several runbooks.
Tabletop exercises are one of the best ways to test playbooks. If players cannot find the playbook, disagree with its decision owners or skip steps because they are impractical under pressure, that is a finding for the after-action report. See the scenario library.