An incident response playbook for digital signage defines what to do when things go wrong — unauthorized content, widespread outage, or suspected breach. Without a playbook, teams panic, waste time, and make mistakes. With one, every incident follows a repeatable process: contain, assess, remediate, recover, learn.
Incident Response Steps
Step 1: Contain
Stop the blast radius. If unauthorized content is showing: push an emergency content override via CMS (takes seconds). If a player is compromised: isolate it by disabling the switch port or VLAN ACL. If the CMS is compromised: disconnect from network and switch to local management.
Step 2: Assess
Determine scope: single player (hardware/network issue), multiple players (CMS or network issue), or fleet-wide (CMS compromise or network attack). Check CMS audit logs to identify the root cause. Review network logs for anomalous traffic from the signage VLAN.
Step 3: Remediate
- Content incident: push correct content via CMS. All players update within seconds
- Player compromise: remote firmware re-flash (DSOS makes this safe — the OS is stateless)
- CMS compromise: revoke affected credentials, rotate API tokens, push corrected content
- Network incident: update firewall rules, re-validate VLAN ACLs, rotate 802.1X certificates if needed
Step 4: Recover and Verify
Bring systems back online incrementally. Verify correct content via remote screenshots. Monitor for 24 hours. Confirm fleet health via CMS dashboard.
Step 5: Post-Incident Review
Document: what happened, when, how it was detected, response time, root cause, remediation steps, and prevention measures. Update the threat model. Update monitoring thresholds. Share lessons learned with the team.
Incident Severity Classification
| Severity | Example | Response Time | Escalation |
|---|---|---|---|
| Critical | Offensive content on public screens | Immediate (< 5 min) | CTO + Legal + PR |
| High | Fleet-wide outage, CMS compromise | < 30 min | IT Director + Vendor |
| Medium | Multiple players offline, stale content | < 2 hours | IT Operations |
| Low | Single player offline, minor content error | < 24 hours | Content team |
Common Mistakes
- No playbook exists. Create one before the first incident. A 2-page document with escalation contacts and basic procedures is better than nothing.
- No emergency content override tested. The emergency push should be tested quarterly. When it matters, there's no time to read documentation.
- No post-incident review. Every incident is a learning opportunity. If you don't document it, you'll repeat it. Update your threat model →