Demo sandbox target
Incident response
Static runbook and escalation summary for human review demonstration.
IR-4 placeholder mapping
Response runbook snapshot
Detect
Security operations
Runbook placeholder current
Triage
Incident commander
Escalation matrix visible
Contain
Platform lead
Manual approval required
Recover
Application owner
Exercise evidence needed
Human reviewers decide whether runbook currency, exercise evidence, and escalation ownership are sufficient for any real audit package.