Abstract: Differences between a first document and a second document are identified. The first document constitutes an authority and the second document constitutes a revision of the authority. A new version of a playbook is created based on the differences, where the playbook is associated with the first document and the new version of the playbook is associated with the second document. Creating the new version of the playbook based on the differences includes determining whether the first document requires a task that is not required by the second document; and responsive to determining that the first document requires the task that is not required by the second document, removing the task from the new version of the playbook. An incident is then received and the new version of the playbook is used to select a set of tasks for resolving the first incident.

Abstract: An incident is created in response to a cyber event. One or more authorities are identified. At least some of the one or more authorities are associated with respective authority conditions and at least some of the respective authority conditions are associated with respective attributes. Satisfaction of the respective authority conditions of an authority identifies the authority. At least some of respective attributes are associated with the incident as incident attributes. Incident attribute values are received from a user for at least some of the incident attributes. Tasks are identified responsive to at least one of the incident attribute values satisfying respective task conditions of the identified tasks. The tasks are then associated with the incident.

Abstract: Responding to incidents includes creating a playbook of tasks based on a first document constituting an authority, such that at least some of the tasks are completed in response to incidents. A new version of the playbook is created based on differences between the first document and a second document constituting a revision of the authority. Responsive to a first incident, the new version of the playbook is used to respond to the first incident. Creating the new version of the playbook includes at least one of excluding a first task of the playbook from the new version, adding an updated task of a second task of the playbook to the new version, or adding a third task to the new version.