Every organization has an incident response plan sitting in a shared drive. Far fewer have one that would actually survive the chaos, adrenaline, and conflicting information of a real 2 a.m. breach. The gap between a plan on paper and a plan that works under pressure is where most incident response programs fail.
The Six Phases, and Where Plans Actually Break
The classic incident response lifecycle: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned, is well known. What’s less discussed is where each phase typically breaks down in practice:
- Preparation breaks when the plan exists but nobody has rehearsed it. Tabletop exercises reveal gaps that documentation review never will, like discovering your incident commander doesn’t actually have the authority to take a production system offline without a VP’s sign-off that’s unreachable at 2 a.m.
- Identification breaks when logging is insufficient to determine scope. “We think it’s contained” is a guess, not a finding, if you don’t have the log retention or visibility to prove it.
- Containment breaks when teams argue about short-term (isolate the host) vs. long-term (preserve evidence for forensics) containment without a pre-agreed decision framework.
- Eradication breaks when teams declare victory after removing the obvious malware but miss the persistence mechanism (a scheduled task, a rogue admin account) the attacker planted as backup access.
- Recovery breaks when restored systems get reinfected because they were restored from backups taken after the initial compromise.
- Lessons Learned breaks because it simply doesn’t happen, teams move on the moment the fire is out, and the same root cause resurfaces in eighteen months.
Building a Plan That Works Under Pressure
- Define roles before the incident, not during it. Incident Commander, Communications Lead, Technical Lead, Legal Liaison: everyone should know their role and its authority boundaries in advance.
- Pre-authorize containment actions. Waiting for executive approval to isolate a compromised host while data exfiltrates is a design failure, not bad luck. Define thresholds where technical staff can act immediately.
- Establish an out-of-band communication channel. If the attacker is in your email system, don’t coordinate the response over email. A pre-arranged Signal group or separate infrastructure avoids tipping off an attacker who may be reading your internal comms.
- Run realistic tabletop exercises quarterly. Use scenarios based on your actual threat landscape (ransomware on a specific critical system, a BEC targeting finance) rather than generic templates.
- Retain forensic-quality logs. Know your log retention windows for every critical system: many incidents are only discoverable in hindsight because logs rotated out before anyone knew to look.
Disaster Recovery: The Partner Discipline
Incident response answers “how do we stop the bleeding.” Disaster recovery answers “how do we get back to operating.” The two must be integrated, because a poorly coordinated recovery can re-introduce the very compromise you just eradicated.
- 3-2-1 backup strategy: three copies of data, on two different media types, with one copy offline or immutable. Ransomware groups now actively target connected backup systems specifically because so many organizations rely on backups that are reachable from the compromised network.
- Test restores, not just backups. A backup you’ve never restored from is a hypothesis. Regularly test full-scope recovery, including timing: do you actually know how long a full restore takes, and does that match your Recovery Time Objective (RTO)?
- Define RTO and RPO per system, not organization-wide. Your customer database might need a four-hour recovery window; your internal wiki can tolerate a day.
The Bottom Line
Incident response plans fail not because organizations lack good intentions, but because they’re written once and never pressure-tested. The organizations that recover fastest from real incidents are the ones that treated their tabletop exercises like a fire drill, annoying, disruptive, and absolutely worth it the one time it matters.