Carmen Young ✳
Incident Response

Your IR Plan Is Probably Incomplete

By Carmen Young

Most Incident Response (IR) plans aren't useless; they are in fact the foundation everything rests on. The problem is that they are incomplete or overcomplicated.

Without clearly defined roles in an operational document, the first question during an incident becomes ‘who is in charge?’ and that question can cost you time you don’t have. Organizations spend so much time developing a plan that aligns with best practices, different frameworks, and vendor suggestions. Yet, they often forget the most critical element: how to execute operations during a live crisis.

The IR plan shouldn't just be a checkbox for your next audit; it should outline how you will handle an incident in real time.

An IR Plan can vary in steps depending on what framework you are looking at. For simplicity I am going to focus on the SANS IR steps:

  • Preparation
  • Identification
  • Containment
  • Eradication
  • Recovery
  • Lessons Learned

For each section your company has spent a significant amount of time figuring out the verbiage each section needs to have to comply with this requirement, but it needs to address more than just the basics. It needs to go beyond just the boilerplate verbiage; it needs to tell your team who is in charge, who is responsible, and what steps to take when it matters most.

The Plan vs. The Playbook

An Incident Response Plan has information as to what frameworks you are following and perhaps what area of your program addresses each section. To address actions needed in an emergency, you need an Incident Response Playbook. This is different than just coming up with ways that you are compliant for the Identification portion of the plan. A playbook can take many forms: a swim lane diagram, a sequence of actions, with supporting documents like a RACI chart to define roles and decision authority.

Your IR plan should have the definitions most plans have, one in particular is the definition of an incident. What constitutes an incident, a breach, an event? These are important because they tell you how to react and cut your downtime significantly.

At some point in your IR Plan you will define your escalation path. For example, in some cases, once the incident surpasses a Tier 3 analyst, you start going into crisis mode. Up until this point, analysts have been following their playbooks and it is now beyond their capabilities. You might even bring in outside assistance. Once this crisis starts, the steps you take go beyond the Security Operations Center (SOC).

According to the SANS Survey State of ICS/OT Security Report, "19% of incidents in 2025 took over a month to remediate… and a striking 3% took over a year." Remember that every minute you spend in containment could be costing you thousands if not millions of dollars. Your Playbook is the key you need to cut remediation time.

Your IR plan is only as good as its contents. If it doesn’t tell your team who is in charge, who is responsible, who makes the decisions, it is incomplete. Pair it with a playbook and you close the gap. There is a lot more to unpack in this space and this series will continue to cover the fundamentals from the perspective of a frontline practitioner, and not a framework entity.