An incident response plan lives in the system, not in a file

An incident response plan should not be a long PDF read during a crisis. Who decides, how we isolate the system, through which channel we communicate, and when we inform the customer must be known in advance.

The first minutes of an incident

First confirm the symptom, estimate the affected area, take a temporary measure that will not grow the damage, and name the incident owner. Avoid random interventions that destroy evidence.

What the plan must have

• Incident types and severity levels.
• Technical and communication owners.
• Isolation, rollback and evidence-preservation steps.
• Conditions for informing legal, customers and suppliers.
• Post-incident learning and remediation.

Tabletop tests

Without waiting for a real attack, walk a scenario as a team — “the customer dashboard is down and there is a suspicious transaction from an admin account”. Where the plan jams is cheaper to learn before a crisis.