# Standards and Regulatory References — Breach Response Team Playbook

## GDPR
- **Art. 32(1)**: Appropriate technical and organisational measures — a documented breach response playbook is an organisational measure demonstrating security preparedness.
- **Art. 32(1)(d)**: Process for regularly testing and evaluating effectiveness — the playbook must be tested through tabletop exercises.
- **Art. 33/34**: Notification obligations that the playbook operationalizes.
- **Art. 37-39**: DPO role — Art. 39(1)(b) requires the DPO to monitor compliance, which includes overseeing breach response preparedness.

## EDPB Guidelines
- **EDPB Guidelines 9/2022 Section 6**: Controllers should have "a procedure in place to address possible personal data breaches" including pre-defined roles, responsibilities, and communication channels.

## NIST
- **NIST SP 800-61r3 (2024)**: Computer Security Incident Handling Guide. Sections 2-3 provide the foundational framework for incident response team structure, preparation, and communication.
- **NIST CSF 2.0**: GV.OC (Govern — Organizational Context), PR.IR (Protect — Incident Response), RS (Respond). The playbook addresses preparation across all three functions.

## ISO/IEC
- **ISO/IEC 27001:2022** — Annex A Control 5.24: Information security incident management planning and preparation. Requires defined roles, procedures, and communication plans.
- **ISO/IEC 27001:2022** — Annex A Control 5.25: Assessment and decision on information security events.
- **ISO/IEC 27001:2022** — Annex A Control 5.26: Response to information security incidents.
- **ISO/IEC 27035-1:2023**: Principles and process for incident management.
- **ISO/IEC 27035-2:2023**: Guidelines to plan and prepare for incident response.

## Industry
- **SANS Incident Handler's Handbook**: Defines the six phases of incident response (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) that the playbook should address.
- **FIRST (Forum of Incident Response and Security Teams)**: Provides CSIRT framework and services guidelines for establishing and operating computer security incident response teams.