incident-management: tighten IR template structure and pipeline runbook#424
Open
frameworks-volunteer wants to merge 2 commits intosecurity-alliance:developfrom
Open
Conversation
built with Refined Cloudflare Pages Action⚡ Cloudflare Pages Deployment
|
Contributor
Author
Second pass updateThis second pass keeps the same philosophy as the first one:
What changed in this pass This pass focuses on the two runbooks that still felt materially underpowered:
1) Strengthened frontend-compromiseThis page now better reflects how frontend incidents actually behave in practice, especially in Web3 where a frontend compromise often becomes a user-signing or Changes include:
The goal here was to make the page more useful during the first minutes of an actual incident, not just more complete on paper. 2) Strengthened dependency-attackThis page was still too close to a stub. It now better distinguishes between a generic vulnerable package and a dependency incident that may have affected real build Changes include:
What I intentionally did not change Still intentionally out of scope:
For example, I left key-compromise unchanged in this pass rather than make lower-confidence edits. Why this is the last pass At this point, the highest-value weak spots in the imported IR template section have been addressed without turning the PR into a broad rewrite. This keeps the contribution focused on:
|
scode2277
reviewed
Mar 24, 2026
| - [ ] Consider using a private registry | ||
| - [ ] Pin exact versions for critical packages | ||
| - [ ] Review dependency changes in PRs | ||
| - [ ] Use deterministic install commands in CI (`npm ci`, `pnpm install --frozen-lockfile`, etc.) |
Collaborator
There was a problem hiding this comment.
in CI environments, pnpm install runs with the frozen lockfile by default
scode2277
reviewed
Mar 24, 2026
Comment on lines
+28
to
+29
| - **Playbooks** elsewhere in the framework, which are reference guidance | ||
| - **Templates**, which are blank working documents to fill out during or after an incident |
Collaborator
There was a problem hiding this comment.
Suggested change
| - **Playbooks** elsewhere in the framework, which are reference guidance | |
| - **Templates**, which are blank working documents to fill out during or after an incident | |
| - **[Playbooks](/incident-management/playbooks/overview)**, which are reference guidance for handling specific types of security incidents | |
| - **[Templates](/incident-management/incident-response-template/templates/overview)**, which are blank working documents to fill out during or after an incident |
scode2277
reviewed
Mar 24, 2026
Comment on lines
+28
to
+30
| - use a template when you need to create a new incident record or post-mortem | ||
| - use a runbook when you need scenario-specific response steps | ||
| - use the policy pages when you need process, roles, or communication expectations |
Collaborator
There was a problem hiding this comment.
Suggested change
| - use a template when you need to create a new incident record or post-mortem | |
| - use a runbook when you need scenario-specific response steps | |
| - use the policy pages when you need process, roles, or communication expectations | |
| - use a [template](/incident-management/incident-response-template/templates/overview) when you need to create a new incident record or post-mortem | |
| - use a [runbook](/incident-management/incident-response-template/runbooks/overview) when you need scenario-specific response steps | |
| - use the [policy page](/incident-management/incident-response-template/incident-response-policy) when you need process, roles, or communication expectations |
scode2277
reviewed
Mar 24, 2026
Comment on lines
+83
to
+84
| - **Incident Management pages** explain concepts and practices | ||
| - **Incident Response Template pages** are meant to be copied, customized, and used internally |
Collaborator
There was a problem hiding this comment.
Suggested change
| - **Incident Management pages** explain concepts and practices | |
| - **Incident Response Template pages** are meant to be copied, customized, and used internally | |
| - **[Incident Management](/incident-management/overview)** explain concepts and practices | |
| - **[Incident Response Templates](/incident-management/incident-response-template/overview)** are meant to be copied, customized, and used internally |
scode2277
reviewed
Mar 24, 2026
Comment on lines
+88
to
+90
| - **Policy / roles / communications / contacts** define your operating model | ||
| - **Templates** are blank working documents to fill out during or after incidents | ||
| - **Runbooks** are scenario-specific response procedures |
Collaborator
There was a problem hiding this comment.
Suggested change
| - **Policy / roles / communications / contacts** define your operating model | |
| - **Templates** are blank working documents to fill out during or after incidents | |
| - **Runbooks** are scenario-specific response procedures | |
| - **[Policy](/incident-management/incident-response-template/incident-response-policy) / [roles and staffing](/incident-management/incident-response-template/roles-and-staffing) / [communications](/incident-management/incident-response-template/communications) / [contacts](/incident-management/incident-response-template/contacts)** define your operating model | |
| - **[Templates](/incident-management/incident-response-template/templates/overview)** are blank working documents to fill out during or after incidents | |
| - **[Runbooks](/incident-management/incident-response-template/runbooks/overview)** are scenario-specific response procedures |
scode2277
reviewed
Mar 24, 2026
Comment on lines
+28
to
+35
| This section contains two different kinds of content: | ||
|
|
||
| - **Framework guidance**: explanatory pages on communication, detection/response, lessons learned, and reference playbooks | ||
| - **Operational templates**: copy-and-adapt incident response documents, templates, and runbooks for internal team use | ||
|
|
||
| Use the framework guidance to understand the discipline. Use the incident response template section to build your own | ||
| operational documentation. | ||
|
|
Collaborator
There was a problem hiding this comment.
Suggested change
| This section contains two different kinds of content: | |
| - **Framework guidance**: explanatory pages on communication, detection/response, lessons learned, and reference playbooks | |
| - **Operational templates**: copy-and-adapt incident response documents, templates, and runbooks for internal team use | |
| Use the framework guidance to understand the discipline. Use the incident response template section to build your own | |
| operational documentation. | |
| This framework contains two different kinds of content: | |
| - **Incident Management core knowledge**: explanatory pages on communication, detection/response, lessons learned, and reference playbooks | |
| - **Incident Response templates**: copy-and-adapt incident response documents, templates, and runbooks for internal team use | |
| Use the core knowledge to understand the discipline. Use the incident response template section to build your own | |
| operational documentation. | |
Collaborator
|
Left some comments @mattaereal |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR is a first pass on the recently added Incident Response Template section.
The goal is not to expand the section broadly, but to make it clearer, tighter, and more operationally credible without adding filler or speculative content.
This pass focuses on three things:
What changed
1) Clarified content taxonomy
Added concise framing so readers can understand what each layer is for:
2) Tightened a few absolute statements
These changes are meant to make the guidance more realistic and less doctrinal.
3) Upgraded the build pipeline compromise runbook
incident-response-template/runbooks/build-pipeline-compromise.mdx was previously a thin stub. This PR upgrades it into a more credible example runbook by adding:
What this PR does not do
Intentionally out of scope for this first pass:
I would rather leave gaps visible than fill them with weak or speculative guidance.
Why this scope
The Incident Response Template addition is already valuable, but right now it mixes:
This first pass tries to make that structure easier to understand, while also strengthening one page that felt materially underdeveloped.
Follow-up ideas (not included here)
Possible future passes, if useful: