AI incident response plan

By Michael Obraitis, Managing Partner, and Michael Dale, CEO · Published August 28, 2026 · Last reviewed August 2026 · ADAM Pulse Knowledge Base

Short answer

Do not stand up a parallel “AI CSIRT.” Fold AI into the incident process you already have. Name what counts as an AI incident, contain with identity and path (revoke the principal, invalidate tokens, block the destination), notify under the rules you already have, preserve tool-call logs rather than chat screenshots, and write the outcome back into the inventory and the acceptable-use policy.

This page is safeguard 11 of AI agent security for business and controls 36–40 of the 40-control checklist. It is risk management, not a new legal notification duty, and not a CMMC or FedRAMP certificate. NIST SP 800-61r3 remains the incident-handling shape. CSF 2.0 Respond and Recover are voluntary grouping language.

1. Define the incident in the existing playbook

If it is not named, it will be filed as “weird email.” Add a short appendix, not a new binder:

• Restricted data (Confidential, CUI if you hold it, credentials, customer lists, source code) pasted into an unapproved tool.
• An agent that sent, wrote, paid or deleted outside policy.
• A compromised AI account or an OAuth grant nobody will own.
• Prompt-injection that caused an external action.
• A runaway loop (cost cap blown, or repeated writes).

This article does not use health-record examples. If you are a covered entity, your existing privacy incident process owns that mapping — point at it.

2. Contain with identity and path

A stern Slack message is not containment. Microsoft’s kill-switch metric is mean time to revoke or disable an agent identity, including token invalidation. Sequence:

1. Disable the user or agent identity in Entra (or the equivalent IdP).
2. Invalidate tokens and revoke OAuth grants. Confirm a cached grant cannot still call Graph or MCP.
3. Disable the tool, Copilot agent, or MCP server registration.
4. Block the destination on DNS / proxy / firewall if the path is consumer SaaS.
5. Preserve first; do not wipe the laptop or the chat history to “clean up.”

If you cannot do steps 1–2 on a non-production agent in a scheduled test, you do not have a kill switch. You have a belief. How to scope the principal beforehand: AI agent permissions and least privilege.

3. Notify under the rules you already have

This article does not create a US AI-incident statute. Use:

• Customer contract notification clauses.
• State breach statutes that already apply to the data involved.
• CUI reporting if you are in that scope.
• Vendor incident channels (Microsoft, OpenAI, Anthropic, Zoom) when their platform is in the path.

Do not skip those because “it was only a chatbot.” A prompt is a data transfer. Counsel decides whether a given event is a notifiable breach; this page tells operators not to hide the facts from counsel.

4. Preserve what you will be asked for

Chat transcripts are not enough. Microsoft’s usual gap is logs that capture the reply and miss the tool call, the scope and the authorization decision. Collect:

• Prompts and retrieved context (without copying more regulated data into a ticket than you must).
• Tool-call logs: tool name, arguments, result, role, scope, correlation ID, “on behalf of.”
• Identity logs: sign-in, consent, role assignment, disable events.
• Network records: DNS, proxy, firewall, for the same window.

If those logs do not exist, that is a finding for the inventory and for safeguard 8 on the pillar, not a reason to invent them after the fact.

5. Feed the outcome back

CSF 2.0 Recover includes improving. Minimum close-out:

1. Add or move the tool on the approved / restricted / blocked list, with a date.
2. Tighten the data class or the allowlist.
3. Update the acceptable-use examples so the next person does not repeat it.
4. Re-test the kill switch.
5. If the root cause was Shadow AI, run intake rather than a gotcha — unless it was malicious, which is rare.

What this plan is not

• Not a CMMC Level 2 or FedRAMP certificate.
• Not EU AI Act conformity. Article 50 transparency (from 2 August 2026) and Article 4 literacy (from 2 February 2025) are Union-market duties for in-scope providers and deployers, not a US IR filing.
• Not a retelling of the July 2026 lab evaluations as if they were customer ChatGPT. Those were specialized cybersecurity tests; the pillar qualifies them against primary disclosures.

Frequently asked questions

Related articles

• AI agent security for business: 12 safeguards — the pillar; this page is safeguard 11.
• AI security checklist for businesses: 40 controls — incident response is controls 36–40.
• AI governance framework for small and mid sized businesses — who owns the playbook when there is no GRC department.
• What happens after a hacker gets into your server? — persistence and why restore-from-backup is not eradication; the non-AI companion.

References

1. NIST SP 800-61r3 — Incident Response Recommendations and Considerations for Cybersecurity Risk Management— the incident-handling shape this page folds AI into. Not an AI-specific statute.
2. NIST CSWP 29 — CSF 2.0— Respond and Recover. Voluntary.
3. Microsoft Learn — Least privilege for AI agents— mean time to revoke including token invalidation; audit fields needed for reconstruction.