Add stubs for two new playbooks.

during.md

@@ -525,3 +525,14 @@ All communication must include the most accurate information available.  Display
 * Share IOCs with [Infragard](https://www.infragard.org/) if applicable.
 * Share IOCs with your servicing [ISAC](https://en.wikipedia.org/wiki/Information_Sharing_and_Analysis_Center) through {{ISAC_CONTACT}}, if applicable.
 
+# Recover
+
+`TODO: Customize recovery steps.`
+
+`TODO: Specify tools and procedures for each step, below.`
+
+**Recovery is typically governed by business units and system owners.  Take recovery actions only in collaboration with relevant stakeholders.**
+
+1. Launch business continuity/disaster recovery plan(s): _e.g._, consider migration to alternate operating locations, fail-over sites, backup systems.
+1. Integrate security actions with organizational recovery efforts.
+

playbooks/playbook-identity-and-access.md

@@ -0,0 +1,65 @@
+## Playbook: Identity and Access Compromise
+
+**Investigate, remediate (contain, eradicate), and communicate in parallel!**
+
+Assign steps to individuals or teams to work concurrently, when possible; this playbook is not purely sequential. Use your best judgment.
+
+### Investigate
+
+`TODO: Expand investigation steps, including key questions and strategies, for identity and access compromise.`
+
+1. TODO
+
+### Remediate
+
+* **Plan remediation events** where these steps are launched together (or in coordinated fashion), with appropriate teams ready to respond to any disruption.
+* **Consider the timing and tradeoffs** of remediation actions: your response has consequences.
+
+#### Contain
+
+`TODO: Customize containment steps, tactical and strategic, for identity and access compromise.`
+
+`TODO: Specify tools and procedures for each step, below.`
+
+* TODO
+
+`TODO: Consider automating containment measures using orchestration tools.`
+
+#### Eradicate
+
+`TODO: Customize eradication steps, tactical and strategic, for identity and access compromise.`
+
+`TODO: Specify tools and procedures for each step, below.`
+
+* TODO
+
+#### Reference: Remediation Resources
+
+`TODO: Specify financial, personnel, and logistical resources to accomplish remediation.`
+
+### Communicate
+
+`TODO: Customize communication steps for identity and access compromise`
+
+`TODO: Specify tools and procedures (including who must be involved) for each step, below, or refer to overall plan.`
+
+In addition to the general steps and guidance in the incident response plan:
+
+1. TODO
+
+### Recover
+
+`TODO: Customize recovery steps for identity and access compromise.`
+
+`TODO: Specify tools and procedures for each step, below.`
+
+In addition to the general steps and guidance in the incident response plan:
+
+1. TODO
+
+### Resources
+
+#### Additional Information
+
+1. <a name="identity-and-access-playbook-ref-1"></a>["Title"](#TODO-url), Author Last Name (Date)
+

playbooks/playbook-supply-chain.md

@@ -0,0 +1,65 @@
+## Playbook: Supply Chain Compromise
+
+**Investigate, remediate (contain, eradicate), and communicate in parallel!**
+
+Assign steps to individuals or teams to work concurrently, when possible; this playbook is not purely sequential. Use your best judgment.
+
+### Investigate
+
+`TODO: Expand investigation steps, including key questions and strategies, for supply chain compromise.`
+
+1. TODO
+
+### Remediate
+
+* **Plan remediation events** where these steps are launched together (or in coordinated fashion), with appropriate teams ready to respond to any disruption.
+* **Consider the timing and tradeoffs** of remediation actions: your response has consequences.
+
+#### Contain
+
+`TODO: Customize containment steps, tactical and strategic, for supply chain compromise.`
+
+`TODO: Specify tools and procedures for each step, below.`
+
+* TODO
+
+`TODO: Consider automating containment measures using orchestration tools.`
+
+#### Eradicate
+
+`TODO: Customize eradication steps, tactical and strategic, for supply chain compromise.`
+
+`TODO: Specify tools and procedures for each step, below.`
+
+* TODO
+
+#### Reference: Remediation Resources
+
+`TODO: Specify financial, personnel, and logistical resources to accomplish remediation.`
+
+### Communicate
+
+`TODO: Customize communication steps for supply chain compromise`
+
+`TODO: Specify tools and procedures (including who must be involved) for each step, below, or refer to overall plan.`
+
+In addition to the general steps and guidance in the incident response plan:
+
+1. TODO
+
+### Recover
+
+`TODO: Customize recovery steps for supply chain compromise.`
+
+`TODO: Specify tools and procedures for each step, below.`
+
+In addition to the general steps and guidance in the incident response plan:
+
+1. TODO
+
+### Resources
+
+#### Additional Information
+
+1. <a name="supply-chain-playbook-ref-1"></a>["Title"](#TODO-url), Author Last Name (Date)
+