Things to know about incident response planning

1. Your insurance policy has conditions

   You cyber insurance policy almost certainly has a few sentences worth of requirements that should be highlighted in your plan.  Almost all insurance plans have requirements of informing your insurance company BEFORE you start trying to fix an issue.  Failure to follow their procedures could result in them not paying your claim if you have to make one.
2. Make sure your IT person or company is aware of conditions in your insurance policy
   
   Your IT person or MSP is there to help.  Make sure they know there are times they need to call the insurance company first. 
3. Begin with the end in mind
   
   Writing an incident response plan is as much about what you do before an incident as it is what you do after an incident.  Installing a security camera after the incident won't help you get it on video.  Once you have a list of incidents that might happen think about prevention.
4. Test your plan

The problems with most incident response plans

The biggest problem with most response plans is they are overly formal and much too long.  What you do not want in the event of an emergency is a fifteen pound one thousand page binder.  You want clear concise instructions on what do to next.  There is good reason the number you call in emergencies is 911 and not distributed as a ten page pamphlet with a flow charge that guides you through what type of emergency you are having and provides individual numbers for the poising control center and fire department broken out by county.

Most incident response plans include a lot of definitions.  This is helpful only in the case of a slow calculated response coordinated across a large team of people or if your emergency is hypothermia and you need to start a fire for warmth. In an incident where someone has stolen your information you need to know what to do next not a definition to classify exactly what kind of information is stolen. 

Incident response vocabulary to help you read more online

• Incident: An incident refers to any event that has the potential to disrupt the confidentiality, integrity, or availability of information or information systems. Examples of incidents in cybersecurity include unauthorized access to a system, data breaches, malware infections, or phishing attacks. An incident response plan outlines the steps you should take to detect, contain, and mitigate the incident. It also includes guidelines for communicating with your IT company, insurance company and customers.

• Accident: An accident, refers to an event that occurs by chance or unintentionally. In cybersecurity, an accident might occur if an employee accidentally deletes important data or misconfigures a system.

• Emergency: An emergency refers to a situation that requires immediate attention and action. In cybersecurity, emergencies might include situations like a ransomware infection.  A more general example would be a server that won't power on and stops your company from working.

• Disaster response plan:  A disaster recovery usually refers to how you will recover data or a server if it is lost.  Sometimes, it refers to how you will operate during a disaster like working out of a second office if there's a fire or working from home during Covid.  It outlines procedures for backup and restoration of data and systems, the allocation of resources, and the restoration of services.