Security · Incident Readiness · 01
Incident response planning
Incident response planning produces the plan an organization will actually use when a security event occurs: who is in charge, how severity is judged, what is done in the first hour, who is notified and when, how evidence is preserved, how decisions are recorded and how the organization returns to normal. It is needed when no plan exists, when the existing plan is a template that names no one, when insurers, customers or regulators require a documented and tested plan, or when a recent event showed that people improvised. Planning produces a plan written to the organization’s structure and providers, severity definitions with the response each triggers, contact and authority matrices, playbooks for the most likely scenarios, and the exercise schedule that keeps the plan real.
Scope
What the review covers.
- Roles, authority and the incident command structure
- Severity classification and response per severity
- Playbooks for likely scenarios: ransomware, business email compromise, data exposure, insider
- Notification obligations: insurer, regulators, customers, law enforcement
- Evidence preservation and record keeping
- Communications, recovery and post-incident review
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Incident response plan | Written to the organization, not a template |
| Scenario playbooks | Step-by-step for the most likely events |
| Contact and authority matrix | Who is called, who decides, with backups |
| Exercise schedule | Tabletop and technical exercises planned |
Prerequisites
What we need from you.
- The current plan, if any, and the insurance policy’s requirements
- Names of internal leaders, providers, counsel and insurer contacts
- A sponsor with authority to approve roles and decisions
Related
Where this sits.
- Incident Readiness Service
- Security Hub
- Tabletop exercises Also
- Ransomware readiness review Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
How long is the plan?
Short enough to be read during an incident. Detail lives in playbooks and appendices.
Does the plan cover our managed providers?
Yes. Providers are part of the response and the plan states what each does and how they are reached.
How often should it be exercised?
At least annually, and after significant change. See Tabletop exercises.