c3.22 Arrange managed incident response
As your environment grows, 24x7 incident response can exceed what an in-house team sustains alone. Arrange managed IR — AWS CIRT, AWS Security Incident Response, or a partner retainer — before an incident, not while one is unfolding.
Implementation guidance
Line up help before you need it
Round-the-clock response across many accounts can overwhelm a small team. Put managed incident response in place in advance and document how to engage it in your playbooks.
AWS options
- AWS Customer Incident Response Team (CIRT) supports customers during active security events — helping triage, contain, and recover — and shares the documented patterns that inform tools like AWS CloudSaga. Confirm your responders know how to engage AWS Support and CIRT before you need them.
- AWS Security Incident Response is a service that helps you prepare for, respond to, and recover from events. It combines automated triage of findings (for example from Amazon GuardDuty) with direct access to AWS CIRT and a console to manage cases, membership, and communications.
Partner retainers
Many AWS Partners offer IR retainers and managed detection and response (MDR). A retainer arranges responders, response-time commitments, and scope in advance. Find them via AWS Partners for security incident response.
Practices
- Establish the service or retainer before an incident and document engagement steps in your playbooks.
- Test the engagement paths (AWS Support, CIRT, retainer) during tabletop exercises.
- Integrate the provider with your detection, communications, and escalation so hand-off is fast.
Watch
How to validate
- Is a managed IR service or retainer in place before an incident, rather than sought mid-incident?
- Do responders know how to engage AWS CIRT and your retainer, and have those paths been tested?
- Is your managed IR provider integrated with your detection, communications, and escalation processes?
Threats addressed
- Security incidents do not follow a convenient schedule; a small team can be overwhelmed when a real event spans nights, weekends, or multiple accounts.
- Without a pre-arranged responder, time spent finding help mid-incident increases dwell time and overall impact.
AWS services
AWS Security Incident Response 
Amazon GuardDuty