Incident Response Planning

Incident response planning is an essential element of the IT security and risk management practice: The worst time to try to figure out how to respond to an incident is in the wake of one actually occurring. Despite this obvious fact, most security professionals admit to being less than fully prepared for the most damaging kinds of incidents around data loss, and nearly half of them fail to adhere to incident response best practices. Establishing effective incident response plans requires you to first build a team consisting of the right type of IT personnel, non-IT stakeholders, and supplemental external support services. You and your team should develop formal plans for critical and common incidents and vet these through tabletop exercises. Implement processes for tracking incidents and the progress of incident response activities, and subsequently analyze this data for future improvements to both prevention and response efforts; tools can help with both of these efforts. Periodically reevaluate your incident response plans, making adjustments for changing threats and changing business risk.