The First 4 Hours
A Practitioner’s Field Guide: the complete three-volume set
Each volume stands alone, with its own index. Read in order (Learn, Run, Operate) or take the one you need.
What you do in the four hours after the phone rings decides how the incident ends. The three volumes cover the universal first-four-hours playbook, that playbook run at four organisational maturity levels, and the templates and decision trees for the live moment.
Companion to the First 4 Hours toolkit: the assessment and ready-to-use templates that put this book to work.
From the blog: The first hour of an incident · Your first tabletop exercise. Essay-length previews of the same ground this set covers, free.
The Four Hours
Volume 1 of the three-volume First 4 Hours set: the universal incident response playbook for the four hours after the phone rings. It covers detection, the first sixty minutes, triage, and containment versus preservation. It then works through the holding statement, who to wake, the response room, scoping, and evidence preservation. It closes on customer communications, the regulatory clock, escalation discipline, and the operator under load. The sixty-minute triage checklist rides along as a working appendix. This volume covers the four hours themselves. Volume 2 covers the four organisational maturity levels, the specialised incident shapes, and the aftermath. Volume 3 is the Operator's Workbook of templates and decision aids. Each volume stands alone. Each is modestly priced in ebook.
The Four Organisations, and After
Volume 2 of the three-volume First 4 Hours set: the incident response playbook run at four organisational maturity levels. Those are the solo operator, the MSP-served small business, the mid-market team, and the enterprise incident response function. The playbook is then bent around the four hardest incident shapes: ransomware, supply-chain compromise, the third-party breach, and insider and lost-device cases. It is carried into the aftermath: the post-incident review, regulatory follow-up after the window closes, and what to change before the next one. The post-incident review template set and the IR Maturity Self-Assessment ride along as appendices. This volume covers the organisations, the hard cases, and the aftermath. Volume 1 covers the four-hour playbook itself. Volume 3 is the Operator's Workbook of templates and decision aids. Each volume stands alone. Each is modestly priced in ebook.
The Operator's Workbook
Volume 3 of the three-volume First 4 Hours set: the Operator's Workbook. It holds the artefacts the narrative volumes describe, organised for the live moment. Those are the holding-statement and customer-communication libraries, escalation trees and decision aids, and the evidence-preservation runbook. It also holds the regulator notification matrix across the major regimes, the template finder that maps every artefact to the moment that calls for it, and the incident response glossary. The customer-communication templates carry three annotations: when to use, how to customise, and what not to include. Every artefact is tagged to the maturity tier it fits. This volume holds the artefacts. Volume 1 is the four-hour playbook itself. Volume 2 covers the four organisational maturity levels, the hard incident shapes, and the aftermath. Each volume stands alone. Each is modestly priced in ebook.
The set at a glance
Swipe sideways to see the full table →
| Volume | Pages | Depth | Price |
|---|---|---|---|
| Volume 1 | 338 | 15 chapters | Paperback $34.99 · Hardcover $44.99 · Ebook $12.99 |
| Volume 2 | 342 | 12 chapters | Paperback $34.99 · Hardcover $44.99 · Ebook $12.99 |
| Volume 3 (Workbook) | 346 | 7 chapters | Paperback $34.99 · Hardcover $44.99 · Ebook $12.99 |
Where to buy
The First 4 Hours will be available in paperback, hardcover, and ebook through print-on-demand retailers, each volume sold separately. The links activate the moment the titles list; until then, email us and we’ll tell you at launch.
Prices shown are our retail list prices; buy links activate when these titles are listed for sale. Books are sold through print-on-demand retailers (KDP, IngramSpark, Amazon, and independent bookstores), not through the Sylvan Assurance toolkit store.
Where a review helps
If this book helped, an honest review on Amazon does more for a small independent press than anything else. We never ask for a rating and never offer anything for one.