Incident Response Playbook

Create an incident response playbook for the following scenario:

**Incident type**: {{incidentType}} (data breach, ransomware, DDoS, insider threat, supply chain compromise, credential stuffing)
**System affected**: {{system}}
**Team size**: {{teamSize}}
**Compliance requirements**: {{compliance}} (SOC2/HIPAA/GDPR/PCI-DSS/none)

Playbook sections:
1. **Detection**: indicators of compromise (IoCs), monitoring alerts, user reports
2. **Triage** (first 15 minutes): severity assessment, initial scope, communication
3. **Containment** (first hour): isolation steps, preserve evidence, block attack vectors
4. **Investigation**: forensic data to collect, timeline reconstruction, root cause analysis
5. **Eradication**: remove attacker access, patch vulnerabilities, reset credentials
6. **Recovery**: restore services, verify integrity, monitor for re-compromise
7. **Communication**: internal (engineering, exec, legal), external (customers, regulators, media)
8. **Post-incident**: retrospective template, action items, metrics to track
9. **Regulatory**: notification requirements and timelines for {{compliance}}

Include checklists that can be printed and used during an actual incident.