Incident Response Plan

Northwind Logistics GmbH · NIS2

Phases

1. Detect — monitoring and staff reports surface a suspected incident.
2. Triage — the security team assesses severity and scope.
3. Contain — affected systems are isolated to limit impact.
4. Eradicate & recover — remove the cause and restore services from backup.
5. Report — significant incidents are notified to the CSIRT within 24 hours (early warning) and a full report within 72 hours.
6. Review — a post-incident review captures lessons learned.