When things go wrong, it helps to be prepared…

In previous blog posts, we discussed the importance of using a risk-based approach to cybersecurity and how it can help you avoid making fear-based decisions (or indecisions). So, say your organization has already gotten a handle on its cyber risk inventory with an annual risk assessment, or even a vulnerability scan. Hopefully your team has already taken steps to mitigate these risks and implement strategic changes to improve your cybersecurity posture. The unfortunate truth is that even with all the right cybersecurity tools, strategies, and education, cyber-attacks are still possible, and they can still slip through your defenses.

That’s where an Incident Response Plan comes into play!

What is an Incident Response Plan?

An Incident Response Plan is your “Break Glass in Case of Emergency” guide, should your organization be targeted by a cyber-attack. You can also think of it like an Evacuation Plan sign posted in a public building, indicating which pathways to take during emergencies such as a fire or tornado. In the heat of the moment, you shouldn’t be forced to figure out how to get to safety while the situation worsens; that should have been figured out and communicated already by safety officials and building managers. For cybersecurity incidents, an IR Plan helps your team stop the spread of the “fire” and keep your cool when the heat is on.

Now that we have a general understanding of what an IR Plan does, let’s dive into some key components to consider when building your own.

What to include in your IR Plan

Roles and Responsibilities

When drafting your Incident Response Plan, it should be very clear “who” is responsible for “what” in the event of a cyber incident. This way, everyone involved in the response process knows what they are expected to do, and split-second decisions are kept to a minimum. Some key roles to discuss and outline in the IR Plan include:

• Incident Manager – The overall “leader” of the response process. They will make sure the response itself runs smoothly by collecting updates from involved parties, sending those updates out to stakeholders, and delegating tasks as needed. The IM will also keep track of the timeliness of the response and handle the IR review meeting to go over lessons learned and suggestions for improvement.
• Tech Manager – The technical expert that assists with the incident response, bringing in internal and external help as needed to contain, eradicate, and recover from the attack.
• Communications Manager – This person will facilitate outside communications via social media, the company website, and interviews with reporters, if appropriate. It is wise to have a response template or two on hand, with room for edits, to help ensure that your outgoing communications are swift and carefully worded.

Communications

Speaking of communications, there are some key considerations for your Incident Response Plan that pertain to internal and external communications, including:

• Methods of communication – Your usual methods of communication might be unavailable or compromised if your system is experiencing a cyber-attack. Have some backup options ready to go to make sure the plan can still function.
• Law enforcement and legal counsel – Establish a relationship with your local law enforcement, including police and FBI, and have their contacts available so you know who to notify that a cyber incident is taking place. Coordinate with your attorney on this and all other processes in your plan to ensure compliance with legal requirements and regulations.
• CISA regional team – Your regional Cybersecurity & Infrastructure Security Agency (CISA) office has resources available to assist you in the event of a cybersecurity incident. Get to know them and what they can and can’t help you with.
• Key stakeholders and partners – Prepare a list of key contacts that may not be directly involved in the incident response, but who would still benefit from staying updated on the evolving situation – or who you may legally need to inform (consult with your attorney on these types of contacts). This list may include your board of directors, business partners, etc.

Test, Review, Repeat

After you create your Incident Response Plan, it’s time to put it to the (tabletop) test! With a tabletop exercise, you can safely simulate what a cyber-attack against your company might look like. A trained cybersecurity expert will create a hypothetical scenario that your team needs to respond to by using your IR Plan. This has the dual effect of putting the plan through its paces and determining any weaknesses or blind spots you may have missed.

The next important step is the review process, which should happen after both simulated and real cybersecurity incidents. The review should cover, in detail, what went right and where there are areas for improvement. Document these details, make any necessary changes to the plan, and schedule your next test and review period. You should also communicate any changes made to the plan to your team for awareness and transparency. Your Incident Response Plan is strongest when it’s treated as a living document that adapts alongside your business and the threats that it faces.

Wrap-up

There are plenty of other details to include in your Incident Response Plan than just the ones highlighted in this article. We recommend checking out the Incident Response Plan Basics guide from CISA for more examples.

Even still, you should have a good idea of what an IR Plan is trying to accomplish and how to maintain your own. Just like the Evacuation Plan posters we mentioned earlier, your IR Plan should provide clarity on what to do during an emergency, with little left up to interpretation or the imagination. It’s a living document that will adapt to your business’ needs and the ever-evolving cybersecurity threat landscape you face, which requires regular testing and review.

More than just providing guidance, your Incident Response Plan should foster confidence across your team that you will be ready if a hacker comes knocking at your door.

For questions or concerns about your cybersecurity strategy, please reach out to us using the form below. Rhodian Group is here to help!

This blog article is part of Summer of Cyber 2025, hosted by Rhodian Group and Angela Adams Consulting. Follow along on their social media pages for insightful and informative cybersecurity content throughout the summer!