Copy of YYYY_MM_DD - Incident Name - VCU Major Incident Response Checklist [TEMPLATE].xlsx

	A	B	C	D	E	F
1	MAKE A COPY OF THIS TEMPLATE TO USE Use this checklist as a guide and log to notate steps taken during the major incident response process. Add other rows/tasks as needed during incident response.
2	Incident Response Lifecycle Stage	Incident Response Task/Step	Responsible Parties	Tips/Resources	Completed?	Incident Notes

3	1. Detection and Activation	On call Incident Response Coordinator (IRC) is alerted of potential major incident detection. IRC coordinates with TS personnel who reported the incident to confirm a major incident is occuring.	Incident Detector/Reporter	Utilize the War Room to collaborate during this step if needed.	FALSE
4	1. Detection and Activation	IRC coordinator confirms an incident has been logged in Cherwell and flagged as major incident (level 1 or 2).	Incident Detector/Reporter	Link to ITSM system:	FALSE
5	1. Detection and Activation	IRC sends chat to TS Major Incident chat space to notify TS of major incident and to join War Room	IRC		FALSE
6	1. Detection and Activation	IRC opens ready-made Incident Response folder to use templates and compile notes/documentation	IRC	Use one of the blank folders, and rename folder and documents using naming convention [YYYY/MM/DD - Incident Name]	FALSE
7	1. Detection and Activation	IRC sends (or delegates sending of) major incident notice to IT community.	IRC	Suggested message to send: TS is aware of an issue with [insert system/service]. Our Incident Response War Room has been initiated and the relevant TS staff are responding. The major incident ticket number to attach child tickets to in Cherwell is [insert ticket number]. We will provide more updates as we have them.	FALSE
8	2. Investigation	In War Room, the known risk, impact and scope of the major incident is confirmed/discussed to determine extent of outage.	IRC and Incident Response Team	Recommended IRC takes notes using Notes template in folder during War Room activities to note issues, improvements, etc. to process.	FALSE
9	2. Investigation	IRC sends "Identified Service Outages and Workarounds" sheet from folder to TS Incident Response Chat space to start documentation	IRC, Incident Response Team, TS personnel	Suggested message to send: TS Staff, please document your system/service outages using this spreadsheet	FALSE
10	2. Investigation	IRC coordinates with TS personnel to determine major stakeholders to receive preliminary outage notifications.	IRC, IRC and Incident Response Team, TS personnel	Refer to Major Incident Comms Management Plan for list of stakeholders. Big ones always include VCU Police, VCU Health System, President's Office, VP Admin, etc.	FALSE
11	2. Investigation	IRC confirms whether ICT needs to be convened	IRC, Senior Leaders	IRC asks TS Senior Leadership to determine whether to activate the VCU ICT, alert other authorities (FBI, Police, etc.) and involve University Relations, VCU Legal, etc.	FALSE
12	2. Investigation	IRC posts initial incident alert on IT Status Page.	IRC	Link to alerts tool.	FALSE
13	2. Investigation	During life of incident, IRC posts status updates on IT Status Page at regular intervals.	IRC	Refer to Major Incident Comms Management Plan for guidelines on status update.	FALSE
14		IRC coordinates with TS personnel to send out regular updates to other identified major stakeholders.	IRC and TS personnel	Refer to Major Incident Comms Management Plan for guidelines on status update.	FALSE
15	2. Investigation	Incident Response Team investigates the root cause of the incident and identifies any workarounds or recovery steps required to restore.	Incident Response Team		FALSE
16	3. Remediation	Incident Response Team initiates repair of affected systems or implements temporary workaround	Incident Response Team		FALSE
17	4. Resolution and Recovery	Incident Response Team returns the IT system or service to the status quo or workaround is implemented and verifies system performance and security.	Incident Response Team		FALSE
18	4. Resolution and Recovery	IRC confirms Incident Response Team has resolved the major incident ticket in Cherwell.	IRC, Incident Response Team		FALSE
19	4. Resolution and Recovery	IRC coordinates with TS personnel to send out updates/recovery estimations to other identified major stakeholders.	IRC and TS personnel		FALSE
20	4. Resolution and Recovery	IRC posts resolution/recovery updates to IT Status Page	IRC	Link to alerts tool.	FALSE
21	4. Resolution and Recovery	IRC coordinates with TS personnel to send out resolution/recovery updates to other identified major stakeholders.	IRC and TS personnel		FALSE
22	4. Resolution and Recovery	Technology System/Service Owners confirm that downed systems and services are restored and update the Identified Service Outages and Workarounds document.	TS personnel	Ensure "Identified Service Outages and Workarounds" sheet is checked off/completed.	FALSE
23	5. Postmortem Report	IRC schedules Post mortem meeting with IRT to be held within one week of incident closure.	IRC, IRT	Start the Post-mortem report (page 1) and share with IRT to document/work on in prep for meeting.	FALSE
24	5. Postmortem Report	IRC uploads recording of War Room to Incident Folder	IRC		FALSE
25	5. Postmortem Report	IRC compiles Post mortem report and submits to IRT and TS Leadership (store in Major Incident Response folder).	IRC, IRT		FALSE
26	5. Postmortem Report	IRC does additional post mortem meeting with other Incident Response Coordinators to review process, procedures, etc. for updates.	IRC	Before or during this meeting create new copy of blank folder with templates to be used at next Major Incident	FALSE
27					FALSE
28					FALSE
29					FALSE
30					FALSE
31					FALSE
32					FALSE
33					FALSE
34					FALSE
35					FALSE
36					FALSE
37					FALSE
38					FALSE
39					FALSE
40					FALSE
41					FALSE
42					FALSE
43					FALSE
44					FALSE
45					FALSE
46					FALSE
47					FALSE
48					FALSE
49					FALSE
50					FALSE
51					FALSE
52					FALSE
53					FALSE
54					FALSE
55					FALSE
56					FALSE
57					FALSE
58					FALSE
59					FALSE
60					FALSE
61					FALSE
62					FALSE
63					FALSE
64					FALSE
65					FALSE
66					FALSE
67					FALSE
68					FALSE
69					FALSE
70					FALSE
71					FALSE
72					FALSE
73					FALSE
74					FALSE
75					FALSE
76					FALSE
77					FALSE
78					FALSE
79					FALSE
80					FALSE
81					FALSE
82					FALSE
83					FALSE
84					FALSE
85					FALSE
86					FALSE
87					FALSE
88					FALSE
89					FALSE
90					FALSE
91					FALSE
92					FALSE
93					FALSE
94					FALSE
95					FALSE
96					FALSE
97					FALSE
98					FALSE
99					FALSE
100					FALSE