The Worst Time to Write an IR Plan Is During an Incident
Small and mid-sized businesses frequently discover they don't have a real incident response plan at the exact moment they need one most — in the middle of an active breach, with systems down, executives asking for answers, and no clear sense of who's supposed to do what. A plan built in a calm moment, even a relatively simple one, consistently outperforms improvisation under pressure.
Why NIST's Six Phases Are the Right Starting Structure
NIST SP 800-61 (the Computer Security Incident Handling Guide) defines a widely adopted lifecycle that works regardless of company size or industry:
- Preparation — policies, tooling, training, and access readiness before anything happens.
- Identification — detecting and validating that an incident is actually occurring, and scoping it.
- Containment — stopping the incident from spreading further, both short-term and long-term.
- Eradication — removing the attacker's access and the root cause, not just the visible symptom.
- Recovery — safely restoring systems to normal operation and confirming the threat is gone.
- Lessons Learned — a structured post-incident review that feeds back into an updated plan.
Using this structure means anyone in your organization — or any consultant you eventually bring in — can immediately understand your plan's shape, because it maps to language used across the industry.
The Two Things Most IR Plans Get Wrong
Beyond the six phases, two elements determine whether a plan is actually usable during a real incident:
- A clear, current team roster. An IR plan that names "the security team" without specific people, roles, and a backup communication channel becomes useless the moment the person who "just knows what to do" is on vacation. Every plan should list actual names and roles — Incident Commander, Lead Security Analyst, Communications Lead — and specify how to reach them if primary systems (like corporate email) are part of the incident.
- Asset criticality tiers set in advance. When multiple systems are affected simultaneously, response teams need to know which to prioritize without debating it in the moment. Ranking assets — Critical, High, Medium, Low — before an incident occurs turns "what do we fix first?" into a five-second lookup instead of a heated meeting.
Keeping the Plan Alive
A plan that sits untouched in a shared drive for two years is not meaningfully different from having no plan — the team roster will be stale, the asset list will be outdated, and nobody will remember the plan exists. The plan should be:
- Reviewed at least annually, and after any significant infrastructure or organizational change.
- Tested through periodic tabletop exercises, where the team walks through a hypothetical incident using the plan as written.
- Updated immediately after every real incident, as part of the Lessons Learned phase — this is the single highest-value moment to catch gaps in the plan.
Who Should Actually Own the Plan
Ownership matters as much as content. If an IR plan is "owned" by an external consultant who wrote it once and left, nobody inside the organization feels responsible for keeping it current, and it quietly rots. The plan works best when a specific named internal role — often the Incident Commander listed on the team roster itself — is accountable for scheduling the annual review, running the tabletop exercise, and updating the document after real incidents. That doesn't mean external help isn't valuable during an actual incident; it means the plan itself needs an internal owner who will notice when it's gone stale.
Start Simple, Then Iterate
A plan that covers your team roster, the six standard phases, and a ranked asset list is already far ahead of having nothing — and it's a document you can realistically keep updated. Perfection isn't the goal on day one; having something specific, current, and actually known to your team is what matters most when an incident actually happens. Print a copy, or keep an offline copy accessible outside your primary systems — if ransomware takes down the file server where your only copy of the IR plan lives, the plan itself becomes part of the incident instead of the response to it.