Nothing Went to Plan..... Because You Didn't Have a Plan

The talk opens with a scenario in which a CISO learns of a breach on a Monday and finds the response chaotic, with unclear decisions, an inaccurate press statement and no defined roles. The speaker argues that a usable incident response plan has to exist before the next incident, and that it should begin with people rather than tools. Many existing plans are bloated, so reviewing and salvaging an old one is a sensible first step.

The middle section walks through the building blocks. Identify key contacts across technology, HR, legal, finance, facilities and regulatory teams, each with a primary and a backup. Agree on definitions for security event, incident and breach with legal, since contract and regulatory wording depends on them. Set severity levels that determine who gets pulled in, add incident categories, and structure the plan around phases from identification through recovery and post-incident review. Other points cover out-of-band communication channels arranged in advance and separating operational response from executive decisions.

To finish, the speaker recommends keeping the document short enough for an executive to read in about ten minutes, with technical detail moved into playbooks. The plan should be tested through tabletop exercises, starting with technical teams, and repeated every year. Writing a first draft and iterating is more useful than waiting for a perfect version.