## Phase 1: Preparation - The Shield

Preparation is everything. "Sweat more in training, bleed less in battle."

### 1. Policy & Procedure
*   **Incident Response Policy**: A high-level document signed by the CEO authorizing the CSIRT to act. (e.g., "CSIRT has the authority to disconnect *any* system, even the CEO's laptop, if infected").
*   **Playbooks (Runbooks)**: Detailed step-by-step guides for specific scenarios.
    *   *Phishing Playbook*: 1. Verify sender. 2. Delete email. 3. Check clicks.
    *   *Ransomware Playbook*: 1. Isolate host. 2. Verify backups. 3. Contact Legal.

### 2. Tools & Resources
You cannot install tools *during* the breach. You need them ready.
*   **Communication**: Out-of-Band methods. If the hackers own your Email server and Slack, how do you talk? (Signal, WhatsApp, Personal emails).
*   **War Room**: A physical or virtual room where the team gathers.
*   **Forensic Workstations**: Laptops ready to analyze evidence.
*   **Jump Kits**: USB drives with static binaries (triage tools) that you can plug into an infected machine.

### 3. The Baseline
You cannot know what is "Abnormal" if you don't know what is "Normal".
*   What ports are usually open?
*   What is the average CPU usage?
*   list of authorized Admins.
*   **Network Diagram**: Essential. You can't defend a network if you don't know it exists.

### 4. Training
*   **Tabletop Exercises (TTX)**: Simulation games. The team sits in a room and talks through a scenario.
    *   Moderator: "Scenario: The CFO's laptop is encrypted and demanding Bitcoin. Go."
    *   Analyst: "I isolate the host."
    *   Moderator: "The host is off-site. You can't reach it."
    *   Analyst: "Oh... uh..."
    *   *Result*: Gap identified! Need a way to isolate off-site hosts.