COMPUTER SECURITY INCIDENT HANDLING FORMS

INCIDENT CONTAINMENT

PAGE __ OF __
DATE UPDATED:_____________

Isolate affected systems:

Command Decision Team approved removal from network?

YES

NO

es
er
ve
d.

If YES, date and time systems were removed: ________________________________________________________

If NO, state the reason: __________________________________________________________________________
_____________________________________________________________________________________________
_____________________________________________________________________________________________

System backup successful for all systems?

YES

sR

Backup affected systems:

NO

ht

Name of persons who did backup:__________________________________________________________________

ig

_____________________________________________________________________________________________

ll R

_____________________________________________________________________________________________

,A

_____________________________________________________________________________________________

03

_____________________________________________________________________________________________

20

Date and time backups started:____________________________________________________________________

Date and time backups complete: __________________________________________________________________

te

Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Backup tapes sealed? YES NO
Seal Date: ________________________

itu

Backup tapes turned over to:______________________________________________________________________

st

Signature:_______________________________________________________ Date: ________________________

SA
NS

In

Backup Storage Location: ________________________________________________________________________

SANS Institute 2003

Prepared By: Greg Jones

All Rights Reserved