You might want to check here:

http://www.sans.org/rr/catindex.php?cat_id=27

SANS has very good stuff on Incident Handling...