I Wrote an Incident Response Plan for My Own Living Room

Almost every incident response plan you'll find is written for a company. Mine is written for a house.

This started as a class assignment: use the format from our textbook to design an incident response plan for a home computer. But it describes my actual setup, which includes servers, a router, cloud accounts, a VPS, and a family that depends on all of it working. Obviously, it's a simplistic exercise in one sense, but there's an importance to boiling IR down to its basic components and knowing how they apply.

Here's the plan, and a few things I learned writing it.

The plan

I used the textbook's format, and it holds up fine at a smaller scale.

• Commitment: I will protect my household's data and review this plan every year.
• Purpose: Limit downtime and data loss.
• Scope: My home computer, servers, router, backups, cloud accounts, VPS, and the people who use them.
• Definition: An incident is anything that harms the confidentiality, integrity, or availability of those systems.
• Roles and authority: I lead, with one other person in the household as my backup. I can disconnect devices and review router logs. I only contact the ISP, the bank, the insurer, or the police, and I share only what each one needs. There's no professional escalation here. We're the only ones who can save us.
• Measures: Time to detect, time to restore, and how much data was lost.
• Forms: An incident log and a home network document wiki.
• Preparation: Local and cloud backups, a UPS and surge protection, and antivirus and updates on everything.

Event responses

The assignment asked for five events. Mine are short on purpose. In the middle of an incident, nobody wants to read a paragraph.

• Virus: Disconnect the device from the network, scan it, change passwords, and restore if necessary.
• Power failure: Shut down safely on the UPS, then unplug everything. When power returns, run parity checks on the array right away.
• Fire: Get out and call 911. Once it's safe, notify the insurance company, then restore from cloud backups when possible.
• Water or flood: Shut off the water and wait for safe conditions. Unplug equipment if it's safe to do so, never power on a wet device, notify the insurer, and restore from backup if necessary.
• ISP failure: Restart the router, call the ISP, and use a phone hotspot in the meantime.

The scenarios I almost skipped

The assignment asked what other scenarios were worth planning for. Theft came to mind first. The second one is the one that stuck with me, which is my own death.

Everyone in my house uses services I maintain, and thousands of family photos upload automatically from phones to a server that syncs every night to a cloud backup. If I'm gone, my family inherits a system that only I understand. I've been meaning to write simple documentation for them, explaining what everything is and how to get into it, and put it on a thumb drive. Writing this plan is what finally pushed me to start.

Here's a caveat for myself, though. A thumb drive full of passwords is a risk on its own, so it needs to live somewhere secure (a fireproof safe, say) and ideally be encrypted. Some password managers also have an emergency access feature built for exactly this.

What Hurricane Helene showed about plans

A plan is only as good as the work done before the disaster, and Hurricane Helene is a good real-world example. In September 2024 it hit North Carolina hard, and the state's response followed the National Incident Management System (NIMS). North Carolina has a state emergency operations plan, plus emergency operations plans for each of its 100 counties, with 15 state area coordinators helping counties plan. Once the governor declared a state of emergency, those plans could be activated, which let the state pre-position assets and resources. NIMS also lets counties and states share resources.

According to EdNC's summary of the lessons learned, counties like McDowell and Henderson credited their pre-storm exercises, relationships, and familiarity with procedures built on "normal days." The third-party review also found real problems: staffing shortages at the state emergency management agency, gaps in cross-training, technology and data-handling issues, and weak logistics.

That lines up with what I'd expect from my own house. Having a plan helps, but it only works if people have practiced it.

Takeaway

Writing this made me see three gaps in my own plan:

• Test the restores. Having backups is not the same as being able to restore from them. I plan to run an actual restore test, not just check that the jobs ran.
• Keep a printed copy. My plan lives in a wiki on my own network. If that's the thing that's down, I can't read the plan. A paper copy in a safe place fixes that.
• Write the handoff down. The most important part of a home plan is the part where somebody else has to be able to use it.

You don't need a big budget or a big team to do this. You need an hour, a list of the things you'd hate to lose, and the willingness to ask "what if I'm not here?"