The First 4 Hours
A Practitioner’s Field Guide: the complete three-volume set
Each volume stands alone, with its own index. Read in order — Learn, Run, Operate — or take the one you need.
What you do in the four hours after the phone rings decides how the incident ends. The three volumes cover the universal first-four-hours playbook, that playbook run at four organisational maturity levels, and the templates and decision trees for the live moment.
Companion to the First 4 Hours toolkit — the assessment and ready-to-use templates that put this book to work.
From the blog: The first hour of an incident · Your first tabletop exercise — essay-length previews of the same ground this set covers, free.
The Four Hours
Volume 1 of the three-volume First 4 Hours set: the universal incident response playbook for the four hours after the phone rings, covering detection, the first sixty minutes, triage, containment versus preservation, the holding statement, who to wake, the response room, scoping, evidence preservation, customer communications, the regulatory clock, escalation discipline, and the operator under load, with the sixty-minute triage checklist as a working appendix. This volume covers the four hours themselves; Volume 2 covers the four organisational maturity levels, the specialised incident shapes, and the aftermath; Volume 3 is the Operator's Workbook of templates and decision aids. Each volume stands alone. Each is modestly priced in ebook.
The Four Organisations, and After
Volume 2 of the three-volume First 4 Hours set: the incident response playbook run at four organisational maturity levels (the solo operator, the MSP-served small business, the mid-market team, and the enterprise IR function), then bent around the four hardest incident shapes (ransomware, supply-chain compromise, the third-party breach, and insider and lost-device cases), and carried into the aftermath: the post-incident review, regulatory follow-up after the window closes, and what to change before the next one. The post-incident review template set and the IR Maturity Self-Assessment ride along as appendices. This volume covers the organisations, the hard cases, and the aftermath; Volume 1 covers the four-hour playbook itself; Volume 3 is the Operator's Workbook of templates and decision aids. Each volume stands alone. Each is modestly priced in ebook.
The Operator's Workbook
Volume 3 of the three-volume First 4 Hours set: the Operator's Workbook, holding the artefacts the narrative volumes describe, organised for the live moment. Holding-statement and customer-communication libraries, escalation trees and decision aids, the evidence-preservation runbook, the regulator notification matrix across the major regimes, the template finder mapping every artefact to the moment that calls for it, and the IR glossary. The customer-communication templates carry three annotations (when to use, how to customise, and what not to include), and every artefact is tagged to the maturity tier it fits. This volume holds the artefacts; Volume 1 is the four-hour playbook itself; Volume 2 covers the four organisational maturity levels, the hard incident shapes, and the aftermath. Each volume stands alone. Each is modestly priced in ebook.
The set at a glance
Swipe sideways to see the full table →
| Volume | Pages | Depth | ISBN | Price |
|---|---|---|---|---|
| Volume 1 | 330 | 15 chapters | TBD | TBD |
| Volume 2 | 327 | 12 chapters | TBD | TBD |
| Volume 3 (Workbook) | 337 | 7 chapters | TBD | TBD |
Where to buy
The First 4 Hours will be available in paperback, hardcover, and ebook through print-on-demand retailers, each volume sold separately. The links activate the moment the titles list; until then, email us and we’ll tell you at launch.
Cover art, pricing, and availability are not yet final and will be updated when these titles are listed for sale. Books are sold through print-on-demand retailers (KDP, IngramSpark, Amazon, and independent bookstores) — not through the Sylvan Assurance toolkit store.