Most incident response plans are excellent documents right up until the moment they are read aloud, in a panic, by someone who was not in the room when they were written. The honest test of a plan is not its executive summary but its worst reader: a competent, frightened stranger at 3 a.m. with partial access and no context. Write for the intern. The intern is not the problem; unearned confidence is.
1. Name the one person who declares it an incident. Pick the decider and a named backup, in writing, with explicit authority to isolate production without waiting for a meeting at 3 a.m. Every real breach stalls first on permission, not on tools. Committees make wonderful dam engineers; during a flood they are simply beavers debating who owns the river.
2. Keep the contact list off the network. Print it. The insurer hotline, your critical vendors, external responders, and one out-of-band channel such as an SMS bridge, because the email system you use to discuss the email compromise is the first thing an attacker may be reading. Paper has never once been phished.
3. Define severity on one page. Sev-1: confirmed attacker access or data leaving the network. Sev-2: confirmed compromise with no evidence of egress. Sev-3: suspicious activity needing a second pair of eyes. Each level gets a named owner and a time-to-page. If the definition of Sev-1 requires a seminar, the intern will default to “it’s probably fine,” a phrase that has ended more lodges than any flood.
4. Write containment as verbs, in order. Isolate the affected machine from the network but do not power it off; powering off destroys the evidence you will need to know how they got in. Snapshot before anyone wipes anything. Export mail and authentication logs before their retention windows roll. Say out loud who is allowed to pull a plug, and say it before the plug needs pulling. You do not drain the pond to catch one fish; you close the gate.
5. Preserve evidence before you tidy. Timestamp everything, record actions in UTC, screenshot dashboards as they were, and write down who did what and when. An incident scene cleaned by an eager administrator is a dam rebuilt directly over the leak.
6. Decide who talks, and to whom, in advance. One spokesperson, pre-approved sentences for customers and staff, and awareness of any notification deadlines your insurance or contracts impose. Draft the customer template now, in calm handwriting; a sentence approved in peacetime is worth forty improvised ones under deadline.
Then exercise it. Run a tabletop twice a year — inject a phishing-driven intrusion and let the intern run the plan while everyone else stays quiet — and write a blameless post-incident review that names failures, not people. A plan exercised once a year is a dam inspected once a year; the difference between the two shows up exactly when it is too late. Version the plan like code, because at 3 a.m. it runs on the least reliable hardware of all: a person.