Tại sao playbook quan trọng
Khủng hoảng IT trung bình cost SME 50-500tr per incident. Doanh nghiệp có playbook → contain nhanh, damage thấp. Không playbook → CEO panic + delegate sai → damage gấp 3-5 lần.
Scenario 1: Server down
Detect (0-5 phút)
- Monitoring alert (UptimeRobot, Pingdom): website không respond.
- Customer report qua Zalo/email.
- Internal team báo lỗi.
Contain (5-30 phút)
- Verify thật sự down hay individual user issue.
- Check status page hosting provider (Cloudflare, AWS, Vercel).
- Engage technical team — IT manager hoặc vendor on-call.
- Communicate: post update trên social + status page "Đang xử lý sự cố".
Recover (30 phút - 4 giờ)
- Vendor/internal team troubleshoot + fix.
- Restart service nếu cần.
- Restore from backup nếu data lost.
- Verify all services back up.
- Communicate "đã khôi phục" + apologize.
Learn (1-7 ngày sau)
Post-mortem meeting: root cause + prevention. Update monitoring + alert + runbook.
Scenario 2: Hack/ransomware
Detect
- Ransomware: file encrypted, demand payment.
- Data breach: external report (security researcher, user).
- Unusual login/access: monitoring alert.
Contain
- Isolate affected systems — disconnect network.
- Preserve evidence (don't reboot, không delete log).
- Engage security team / company external.
- Notify law enforcement nếu serious.
- Communicate cẩn thận — không panic public yet.
Recover
- Restore from clean backup (đảm bảo backup không bị compromise).
- Reset all credentials (password, API keys, certificates).
- Patch vulnerability that allowed breach.
- Verify clean trước khi back online.
Compliance ND13
Nếu data lộ + có dữ liệu cá nhân → báo Bộ Công an trong 72h + thông báo user bị ảnh hưởng. Late report → phạt nặng hơn.
Scenario 3: Data loss
Causes: lỗi nhân viên xoá nhầm, hardware failure, ransomware, database corruption.
Recovery priority
- Recent backup: restore.
- Point-in-time recovery (cloud DB): rollback time T-X.
- Reconstruct từ source: email logs, audit trail, customer records ngoài.
- Accept data loss: post-X cannot recover, communicate to user.
Playbook templating cho doanh nghiệp
Doanh nghiệp viết playbook 5-10 trang trước:
- Contact list: CTO, IT manager, vendor on-call, lawyer, PR.
- Severity matrix: P0 (full down), P1 (partial), P2 (degraded), P3 (minor).
- Response time SLA per severity.
- Communication template (internal, customer, public).
- Recovery procedure step-by-step.
- Post-mortem template.
Practice drill 1-2 lần/năm
Tabletop exercise: scenario giả lập, team chạy playbook. Phát hiện gap → update playbook. Real drill (cố ý down 1 server) cho team experience.
Doanh nghiệp cần playbook + drill IT crisis? Alodev gói consulting 25-60tr cho 8-12 tuần. /lien-he