← VCE Software Development U4O2

Incident response planning

A plan written in advance that sets out who does what to detect, contain, recover from and learn from a cyber security incident, including roles, contacts, reporting and review.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 125

Understanding Incident response planning in VCE Software Development U4O2

What it does: Assigned roles and contacts are written in advance. The code shows each role mapped to a named person. A plan sets out recovery steps ahead of time. Restoring from a backup and then checking the system is a typical order. A plan only helps if people know what to do the moment something goes wrong. Writing it during a crisis wastes time and leads to mistakes. The plan sets out who does what and who to call. Source code is not part of the plan. Containing limits the damage and stops the incident spreading. Writing up lessons learned happens later, in the review stage.

Common mistakes: Containing an incident means isolating the infected device so the threat cannot spread. Sharing files from it could spread the infection. It should be isolate(infectedDevice). The Incident Manager's duty is to lead the response. Deleting logs destroys evidence needed to investigate the incident. It should be duty <- 'lead the response'.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Incident response planning to a class →

This module's key terms are also in a printable crossword (Modules 97–130) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
When should an organisation write its incident response plan?
In advance, before an incident happensAfter an incident has already started
Matches
if (breach) { wait(); } // plan: decide who to call later
↓
The response is not planned in advance. Roles and contacts must be decided and recorded before an incident, not worked out during one.
Applying
Meanings
Term
incident response plan
Meaning
A plan written in advance that sets out who does what to detect, contain, recover from and learn from a cyber security incident, including roles, contacts, reporting and review.
Practice
PLAN IncidentResponse
Testing
Gaps
(server)
Check Answer
Spots
1IF alert = TRUE THEN
2 shareFiles(infectedDevice)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Coelacanth' badge — Living Fossil, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. When should an organisation write its incident response plan?
A. In advance, before an incident happens ✓
B. After an incident has already started
A plan only helps if people know what to do the moment something goes wrong. Writing it during a crisis wastes time and leads to mistakes.
2. Which belongs in an incident response plan?
A. Only the source code of the software that was attacked
B. A list of roles and who to contact, such as the incident manager and IT security lead ✓
The plan sets out who does what and who to call. Source code is not part of the plan.
3. Which step is about containing an incident?
A. Isolating an infected computer from the network to stop malware spreading ✓
B. Writing a report about what the team could do better next time
Containing limits the damage and stops the incident spreading. Writing up lessons learned happens later, in the review stage.
4. Which step is about recovering from an incident?
A. Deleting the access logs so the incident is hidden
B. Restoring systems and data from a clean backup ✓
Recovery returns systems to normal operation, often using backups. Deleting logs destroys evidence needed for investigation and learning.
5. After an incident, what should a response plan require the team to do?
A. Review what happened and update the plan and security controls ✓
B. Return to normal and avoid discussing the incident
Learning from incidents is a core part of the plan. Reviewing the response and fixing the gaps reduces the chance of it happening again.

Match the Pairs

contain(incident) → The containment step of an incident response plan: isolate affected systems or accounts quickly so the incident cannot spread further.
lessonsLearned(report) → The review step of an incident response plan: analyse what happened and update the plan and controls so it is less likely to happen again.
The plan names who does what and who to contact, so nobody has to guess during an incident. → roles = {"lead": "Sam", "comms": "Priya"}
Recovery follows a set order, such as restoring systems from a backup before returning to normal operation. → restore(backup); verify(system)
if (breach) { wait(); } // plan: decide who to call later → The response is not planned in advance. Roles and contacts must be decided and recorded before an incident, not worked out during one.
recover(system); closeIncident(); // no report written → The incident is closed without reporting or reviewing it. The plan should include reporting and lessons learned so the plan and controls can be improved.

Key Term

incident response plan
A plan written in advance that sets out who does what to detect, contain, recover from and learn from a cyber security incident, including roles, contacts, reporting and review.

Fill in the Blanks

1. IF alert = "malware" THEN isolate(server) END IF
Hint: Type the containment action that disconnects the affected device so the incident cannot spread.
2. incidentLead ← "IT Manager" notify(incidentLead)
Hint: Type the function name that contacts the person named in the plan as responsible for coordinating the response.
3. isolate(server) restore(server, backup)
Hint: Type the recovery step that brings the system back using clean backup data.
4. IF dataBreach = TRUE THEN notify(OAIC) END IF
Hint: Type the Boolean value that means a breach has occurred, so the reporting step runs.
5. recover(server) review(incidentLog) update(incidentPlan)
Hint: Type the lessons-learned step that examines what happened once recovery is finished.

Spot the Error

Question 1
A IF alert = TRUE THEN
B shareFiles(infectedDevice)
C restore(cleanBackup)
D END IF
Line B — Containing an incident means isolating the infected device so the threat cannot spread. Sharing files from it could spread the infection. It should be isolate(infectedDevice).
Question 2
A role <- 'Incident Manager'
B duty <- 'delete all the logs'
C contact <- '0400 000 111'
Line B — The Incident Manager's duty is to lead the response. Deleting logs destroys evidence needed to investigate the incident. It should be duty <- 'lead the response'.
Question 3
A isolate(server)
B removeMalware(server)
C restore(server, infected)
Line C — Recovery means restoring systems from a clean backup. Restoring from an infected source would bring the problem straight back. It should be restore(server, cleanBackup).
Question 4
A IF breach = TRUE THEN
B notify(manager)
C hide(breach)
D END IF
Line C — A reporting step in the plan means telling the right parties, such as the OAIC for an eligible data breach. Hiding the breach breaks the law and the plan. It should be report(OAIC).
Question 5
A IF incident = ongoing THEN
B review(response)
C updatePlan(lessons)
D END IF
Line A — The review and learning stage happens after the incident is resolved, not while it is still ongoing. The condition should be incident = resolved.

Student with a class code? Join your class →