An incident response (IR) plan is just books on a shelf if it is not maintained. These written guides, which show how organisations should detect, respond to and limit the effects of a security incident, are too often left gathering dust. So many plans go untried and untested for years, becoming so outdated they are unfit for purpose when a data breach actually happens.
An IR plan today should include a policy that defines what an incident is and a step-by-step guide of how the business responds. Done right, organisations can lessen the blow of an attack and reduce the costs and recovery time that usually come with breaches.
Even with everything happening in the news, some companies still do not have one in place.
Fixing the IR plans
More often than not the plan does not fit the purpose. Some IR plans are so poorly designed that in an actual emergency they would do no good. One common point of failure is putting one or two people in charge of the entire crisis response. If both are unavailable, who leads? Have a plan, train against the plan, and make sure everyone knows their responsibilities.
How it should look
When building an IR plan you need a defined purpose, the role of each team member, and the lifecycle of the plan itself. Run exercises. A practitioner consensus is to use six phases: 1) Preparation 2) Identification 3) Containment 4) Eradication 5) Recovery 6) Lessons Learned. Have cross-department reps who can lead in their part of the business so the response is coordinated rather than centralised.
Team and skills
Diversity in the team executing the plan matters. Communication makes or breaks an IR plan. Plans rely on good intelligence and clear reporting from managers, who turn it into business language for company leaders. Attackers spot holes in plans quickly; do not give them the chance.
Take the plan off the shelf, blow some dust off, and check it is still applicable. A robust plan is achievable as long as you have the right processes, the right people, and test it regularly.
Originally published 10 May 2017. Migrated to the new IRC site in 2026.