How to Build an Incident Response Plan That Actually Works
Every organisation has an incident response plan. It’s buried somewhere in the shared drive, probably last updated eighteen months ago, and references a team structure that no longer exists. If a breach happened right now, could your team actually follow it?
The difference between a plan that works and one that crumbles under pressure comes down to three things: realism, practice, and ownership. Without all three, your plan is just a document.
Start With Realistic Scenarios
Generic incident response plans that cover every conceivable scenario tend to be too vague to be useful in practice. Instead, build your plan around the threats most relevant to your organisation.
If you process customer payment data, plan specifically for a card data breach. If you rely on cloud infrastructure, plan for a compromised admin account. If you’ve recently undergone external network penetration testing, use the findings to shape your scenarios around the actual vulnerabilities in your environment.
William Fieldhouse, Director of Aardwolf Security Ltd, comments: “The incident response plans that fall apart in a crisis all share a common trait: they were written to satisfy a compliance requirement and never tested against a realistic scenario. Plans that work are ones that have been practised, refined, and updated based on what the team learned during tabletop exercises.”
Define Roles Before the Crisis Hits
During an active incident is the worst time to figure out who’s responsible for what. Your plan should name specific roles with named individuals and backups. Who leads the investigation? Who handles communications? Who makes the call to engage external forensics?
These roles should cross departmental boundaries. Legal, communications, IT, senior management, and potentially HR all have responsibilities during a serious incident. If they haven’t been briefed on their roles before the crisis, coordination falls apart when it matters most.
Practice Makes Permanent
Tabletop exercises are the single most effective way to stress-test your incident response plan. Gather your incident response team, present them with a realistic scenario, and walk through the plan step by step.
You’ll quickly discover gaps. The contact details for your forensic provider are out of date. Nobody knows how to access the network diagrams. The legal team wasn’t aware they had a 72-hour GDPR notification obligation. These discoveries during an exercise are valuable. The same discoveries during a real breach are expensive.
Keep the Plan Alive
Review and update your plan after every exercise, every real incident, and every significant change to your infrastructure. Treat it as a living document, not a compliance artefact.
If your organisation doesn’t have a tested incident response plan, or if the plan you have hasn’t been exercised in over a year, getting a penetration test quote for a combined assessment and incident response planning engagement is a practical starting point. Preparing for a breach costs a fraction of responding to one without preparation.
