System for protecting at least one device (DEV1,...,DEV3) of a target infrastructure (TINF) against a cyber incident, whereby an infrastructure database contains device-specific information for its devices (DEV1,...DEV3), with the following units: - Playbook providing unit for providing a security playbook for the given cyber incident, whereby the playbook describes steps (S1, S2) to be executed in reaction to the cyber incident and placeholders (PH1,..., PH2) to be replaced with device-specific information when the security playbook is applied to the target infrastructure; - Instantiation unit for transforming the security playbook to a transformed playbook, whereby the transformation replaces the placeholders (PH1, PH2) with the device-specific information according to the infrastructure database; - Step processing unit for analyzing the respective step (S1, S2) of the transformed playbook based on a policy and process database (PPDB), which shows a rule indicating whether at least a part of the step (S1, S2) can be executed without any restriction or only with a restriction or has to be blocked, and for forming a labeled playbook based on the transformed playbook showing the respective rule for at least one part of the step (S1, S2) indicated by a respective handling label; - Handling unit for executing the steps (S1, S2) based on the labeled playbook taking the handling label into account and for generating at least one instruction (INST) derived from at least one of the steps (S1, S2); - Deployment unit for generating a device-specific command based on the instruction (INST) and based on a syntax processable by the device, whereby the device-specific command is transmitted via a message to the device for processing the device-specific command by the respective device. - Playbook providing unit for providing a security playbook for the given cyber incident, whereby the playbook describes steps (S1, S2) to be executed in reaction to the cyber incident and placeholders (PH1,..., PH2) to be replaced with device-specific information when the security playbook is applied to the target infrastructure; - Instantiation unit for transforming the security playbook to a transformed playbook, whereby the transformation replaces the placeholders (PH1, PH2) with the device-specific information according to the infrastructure database; - Step processing unit for analyzing the respective step (S1, S2) of the transformed playbook based on a policy and process database (PPDB), which shows a rule indicating whether at least a part of the step (S1, S2) can be executed without any restriction or only with a restriction or has to be blocked, and for forming a labeled playbook based on the transformed playbook showing the respective rule for at least one part of the step (S1, S2) indicated by a respective handling label; - Handling unit for executing the steps (S1, S2) based on the labeled playbook taking the handling label into account and for generating at least one instruction (INST) derived from at least one of the steps (S1, S2); - Deployment unit for generating a device-specific command based on the instruction (INST) and based on a syntax processable by the device, whereby the device-specific command is transmitted via a message to the device for processing the device-specific command by the respective device.