County-Wide Incident Response Playbook

Mansfeld-Südharz, Germany - November 20, 2025

Anhalt-Bitterfeld invites every SME, clinic and municipality to shape a single crisis manual

The first public reading of the draft incident response playbook took place in the old fire-brigade canteen at Dessau-Rosslau station 3, a building that still smells of diesel and wet concrete even though the engines left twenty years ago. Around the scarred wooden table sat a dozen people who normally never share the same air: the IT apprentice from a 40-man valve manufacturer, the head of infrastructure at the district hospital, the county’s chief information security officer, and the communications director of the local savings bank. They were not there to exchange business cards; they were there to decide who calls whom when the pixels start burning. The draft in front of them—120 pages, 48 procedures, 12 decision trees—will become binding for every organisation that draws water, power or data from the same grid, because experience from the 2024 water-utility breach in neighbouring Magdeburg showed that silence travels faster than malware once taps stop flowing.

The philosophy behind the manual is simple but unforgiving: an incident that can bankrupt a 200-employee metal shop in the morning can paralyse a county hospital by lunch and freeze the municipal payroll by dinner. Traditional IR playbooks assume a single perimeter; the county playbook assumes a single fate. The document therefore starts with a mutual-aid clause that turns isolated victims into temporary teammates: if your SOC is overwhelmed, you may shift your logging pipeline to the shared Alliance SIEM for up to 72 hours without transferring personal data outside German jurisdiction. The clause is activated by a one-click MoU that is pre-signed and stored in the county clerk’s office, removing the legal hesitation that cost Magdeburg’s water supplier six extra hours of downtime while lawyers argued over data-processing agreements. During those 72 hours the borrowed SOC bears the cost; the victim keeps the logs; and when the crisis ends both parties produce a joint post-mortem that is anonymised and published in the open-data portal, turning a private scare into a public antibody.

Escalation is handled through a single telephone tree that terminates in two places: the county crisis command post and the European CSIRT network. The tree is shallow by design—only three hops—because every extra layer adds exponential delay. The first hop is a dedicated 24-hour hotline staffed by the Alliance’s own duty officers who hold NATO SECRET clearance and can therefore translate technical indicators into law-enforcement intelligence without breaking confidentiality. The second hop triggers the county’s disaster-protection plan, which means the same sirens that warn of floods now also warn of data floods: a 400 Hz tone followed by a voice message on the regional radio station that tells citizens whether to boil water, evacuate, or simply reboot their routers. The third hop is automatic: once the county declares a “cyber emergency” the Federal Office for Information Security (BSI) is obliged to allocate national remediation resources within two hours, a statutory privilege normally reserved for critical infrastructure operators but extended to the entire county through a novel clause in the State Crisis Act that was quietly inserted last spring after the Magdeburg incident. The clause is the first of its kind in Germany and effectively turns 160 000 inhabitants into a single critical-infrastructure block, amplifying their collective voice in the national incident-response queue.

Communication discipline follows the old civil-defence rule: one voice, many channels. The playbook designates a single incident spokesman—always the county’s head of communications—who alone is authorised to speak to media, citizens and suppliers. All other organisations route their statements through this funnel, ensuring that Twitter, local radio and the LED road signs above the A9 motorway carry the same message at the same minute. The template messages are pre-written in 140-, 280- and 1 000-character versions and translated into German, English, Turkish and Russian, covering 92 % of the resident population. A falsehood counter-procedure runs in parallel: every fifteen minutes the Alliance scrapes social media for rumours, hashes the content, and pushes a contradiction if the hash matches a known false pattern. During the first public drill in September the counter-procedure squashed a fake evacuation order within four minutes, preventing the kind of panic that killed seven people during the 2021 fuel-pipeline ransomware case in the USA. The county’s interior minister, who watched the drill from a glass-walled gallery, later said that those four minutes felt shorter than any flood warning he had ever issued, because the playbook had already decided who would press which button before the rumour was even born.

"An incident that can bankrupt a metal shop by breakfast can paralyse a hospital by lunch—so we write one plan, not three."

Technical recovery is described in only twelve pages, because the authors assumed that most organisations already own backup software and patch calendars; what they lack is choreography. The playbook therefore focuses on decision velocity: how to declare incident severity levels, when to involve insurers, when to notify data-protection authorities, and in which order to restart services so that dependencies do not collapse like dominoes. A colour-coded timeline runs sideways across every page, showing the same 48-hour window from three perspectives: operational, legal and communicative. A factory owner can therefore see at a glance that the moment he isolates his ERP server is also the moment he must inform his works council, and that the press release can wait until the second DNS TTL cycle has expired. The timeline is printed on waterproof paper and taped inside every server room that joins the alliance, a low-tech artefact that still works when the hypervisor is encrypted and the phones are dead.

The final chapter is the only one written in mandatory language: it obliges every signatory to run a full-spectrum live-fire exercise once per calendar year, with the county acting as red-team and the BSI as observer. The exercise must include a public element—citizens receive test alerts, local radio interrupts programming—so that resilience is rehearsed not as an IT ritual but as civic choreography. The first such exercise is scheduled for 17 June 2026; the playbook will be frozen thirty days beforehand, published online, and opened for public comment for six weeks, turning the county into an open-air laboratory for crisis culture. Comments are not advisory; if more than fifty substantive revisions are received, the text is re-issued and the exercise is postponed, a feedback loop that treats democracy as a dependency of cybersecurity rather than a decorative extra. By the time the frost returns to the Buna site next winter, the manual will bear the fingerprints of plumbers, nurses, teachers and retirees—proof that an incident response plan ages well only when it is written by the same people who will have to live inside it when the sirens sound.

The Cyber Resilience Alliance is a public-private partnership established 2025, led by CypSec, Validato and the County of Mansfeld-Südharz. The Alliance operates a sovereign private-cloud security stack, a shared SOC and an cyber academy, aiming to make Mansfeld-Südharz the reference site for rural cyber resilience by 2030.

Media Contact: Daria Fediay, Chief Executive Officer at CypSec - daria.fediay@cypsec.de.