01 — Establish authority and the incident boundary
Identify the business owner, incident lead, affected AI service and current operational impact. Agree permitted actions, confidentiality, evidence access and a communication cadence. Record what remains unknown.
02 — Preserve the evidence that can disappear
Capture relevant configuration versions, run IDs, input-source references, tool traces and downstream events. Work within retention windows and privacy boundaries. Where immediate harm requires urgent containment, the incident owner balances preservation with service protection.
03 — Contain the affected capability
Select the narrowest effective boundary: workflow, connector, source, credential or permission. Have authorised owners approve changes, document expected consequences and retain a rollback path where appropriate.
04 — Reconstruct and scope impact
Build a timeline from independent records. Separate model text, tool attempts and confirmed operations. Correlate identities, data sources and destination logs; label uncertainty rather than filling gaps with a plausible narrative.
05 — Validate recovery and hand over
Define acceptance criteria for permissions, trusted sources, legitimate use and the original failure condition. Restore in controlled stages and assign owners to residual risks and longer-term work.
Coordinate parallel work without losing accountability
Containment and evidence collection may need to run together. Maintain one incident lead and a decision log so a configuration change does not silently invalidate an investigator’s assumptions. Record the before-and-after state, time, approver and result. The relevant owner balances evidence preservation against continuing harm.
Use gates that can be checked
| Decision | Minimum record to agree |
|---|---|
| Start collection | Question, permission, relevant time window and handling route |
| Apply containment | Owner, affected dependency, expected impact and verification |
| Expand scope | New evidence or question, cost implications and approval |
| Restore service | Validation result, residual risk and acceptance owner |
Connect method to practice
Use the response plan structure for ownership and the forensic evidence map for reconstruction. NIST SP 800-61 Rev. 3 is a risk-management reference, not a certification of this service.
