SANS Incident Response Framework — Plans, Playbooks and Retainers
The SANS incident response framework breaks an incident into six steps — Preparation, Identification, Containment, Eradication, Recovery and Lessons learned (PICERL). It is the most widely used structure for incident response plans and playbooks.
Mutex Systems writes plans and playbooks on the SANS model, aligns them with NIST SP 800-61 Rev. 3, and runs the response through our managed SOC and incident-response retainer.
- Category
- Compliance Framework
- Jurisdiction
- International
- Issuing Body
- SANS Institute (with NIST SP 800-61 as the companion standard)
- Current Version
- SANS six-step model; NIST SP 800-61 Rev. 3 (April 2025) aligns incident response with NIST CSF 2.0
- Who It's For
- Any organisation that must respond to and report incidents — especially those under NIS2, DORA, UK GDPR, CTDISR or SBP reporting deadlines.
Core Domains
A Practical Compliance Path
- 01
Readiness review
Assess current plans, logging, contacts and reporting obligations.
- 02
Plan & playbooks
Write the IR plan and playbooks for ransomware, data theft, account takeover and insider cases.
- 03
Exercise
Tabletop exercises with technical and executive teams.
- 04
Respond
Retainer with 24-hour hotline and one-hour initial response.
Plans that work at 3am
Short playbooks with named decision-makers, pre-agreed containment actions and regulator contact details.
- Ransomware and data-theft playbooks
- Tabletop exercises
- Notification timelines per regulator
Incidents, deadlines and lessons in one place
grComply records incidents on an immutable timeline, links them to affected controls and risks, and tracks lessons-learned actions to completion.
- Incident records with full timeline
- Reporting obligations and deadlines tracked
- Lessons-learned actions as tasks with owners
- Evidence for ISO 27001 5.24–5.28 and NCSC CAF objective D
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About SANS IR
What does PICERL stand for?
Preparation, Identification, Containment, Eradication, Recovery and Lessons learned — the six phases of the SANS incident response model.
How is SANS different from NIST SP 800-61?
They cover the same ground. SANS splits response into six practical steps; NIST SP 800-61 Rev. 3 now organises incident response around the NIST CSF 2.0 functions. We map plans to both.
Do we need an incident response retainer?
If you have short regulatory reporting deadlines or no in-house responders, a retainer means experienced help starts within an hour rather than after a procurement process.
Ready to Start Your SANS IR Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.