Free security operations template

RMM incident response runbook

A vendor-neutral worksheet for coordinating a suspected RMM account, automation, remote-access, or endpoint-management security incident. The CSV provides 30 controls across preparation, evidence preservation, containment, investigation, recovery, communication, and improvement.

Download the CSV Open the incident response guide Open the RMM security checklist

What the runbook covers

Readiness and activationName command roles, preserve emergency contacts, define severity, and test break-glass access before an incident.
Detection and scopeRecord the first indicator, affected tenants, users, endpoints, integrations, automations, and provisional severity.
Containment and investigationRestrict risky access, pause automations, preserve audit logs, build a UTC timeline, and determine blast radius.
Recovery and improvementRotate secrets, restore in controlled stages, monitor recurrence, notify stakeholders, and verify corrective actions.

How to use it

  1. Copy the CSV into your incident platform, ticketing system, or secured spreadsheet.
  2. Replace generic owners, severity definitions, contacts, and communication audiences with approved names and channels.
  3. Record actions and evidence in UTC; preserve original logs and alerts rather than editing them in place.
  4. Use legal, contractual, cyber-insurance, and regulatory guidance to decide notification requirements.
  5. Keep corrective actions open until a named reviewer verifies evidence—not merely until an owner marks them complete.

For the complete eight-stage workflow—including independent control paths, incident scope, containment, evidence handling, recovery, and endpoint reconciliation—read the RMM incident response checklist.

This worksheet is an operational planning aid. It is not legal advice, forensic guidance, or a substitute for your organization’s incident-response, notification, evidence-handling, and insurer requirements.

Field reference

The CSV uses consistent fields for phase, control ID, activity, owner, priority, status, evidence, decision, communication audience, next review time, and notes.

Relationship disclosure

This template is maintained by the Nizlo team. Nizlo is a Windows-first RMM and IT-management platform for MSPs and IT teams. The runbook is deliberately vendor-neutral and does not claim that Nizlo or any other vendor satisfies these controls.