We have helped several orgs with incident response and this is the playbook that we used.