The Importance of an Incident Response Plan

The talk starts by separating an incident response policy, which states intent, from an incident response plan, which spells out the concrete steps to follow when something goes wrong. The speaker argues that many organizations still lack a plan, even though nearly every job now touches digital systems. Physical security, badge access and cameras now run on the same networks, so disaster planning has to cover them too.

The middle of the talk covers what a usable plan contains: an escalation chain that says who gets called first, including legal and insurance contacts, internal and external communication paths for when systems are down, reporting obligations, and industry-specific requirements tied to compliance frameworks. She recommends keeping a short printed or desktop version alongside the full document, and testing the plan with drills and tabletop exercises. Examples from her work include backup power that lasted only minutes and off-site data copies held too close to the primary site.

She closes by noting that insurers increasingly ask to see incident response documentation, and that claims can be denied over missing paperwork. The plan should be reviewed regularly, updated after each incident, and tailored to the organization's industry rather than copied from a template.