The incident response plan you'll actually read (and test)

We've seen it, more than once. An incident response plan sitting in a folder no one has opened since it was drafted three years ago, by a consultant who no longer works there, referencing tools that were replaced two migrations back.

That's not a plan. That's a wish.

A plan is a plan when it's short enough to read, current enough to trust, and rehearsed enough that people know what to do when it's 6:23am and someone's noticing weird files on the accounts inbox.

Here's what actually goes into ours, and how we keep it alive.

The short-form IRP

Two pages, maximum. A one-line summary of the scenario categories (ransomware, business email compromise, lost device, data breach, prolonged outage). Named humans for each role — decision-maker, IT lead, communications, HR, legal. Phone numbers that work. A decision tree with three options at each branch, not seventeen.

If it takes more than five minutes to read, no one will read it at 2am.

The runbooks that sit under it

Under the short-form plan, we hold longer runbooks per scenario. Ransomware: isolate, preserve, evaluate, notify, restore. Business email compromise: reset, review mail rules, hunt for lateral movement, notify. These live in a place your team can actually access when the primary email account is compromised — not only in your primary email.

The tabletop

Once a year, minimum, we walk your leadership team through a plausible scenario for your business. Ninety minutes. Coffee. No production impact. We ask questions like: "it's a Friday afternoon, the phones are ringing, your bookkeeper's email is sending invoices with new bank details — who's authorised to shut off outbound mail, and how quickly?" It's less dramatic than it sounds and more useful than you'd expect.

An incident response plan on file and tested is included in the Cybersecurity baseline — not a paid extra.

The one benefit nobody sells you

A tested IRP is one of the fastest ways to reduce your cyber insurance premium at renewal. Insurers ask about it directly. A one-line "yes, we have one" isn't the same as evidence of a tested one.