You Need a Plan, Not a Team
Most small and mid-size organizations don't have a dedicated security team. That doesn't mean you can skip incident response planning — it means your plan needs to be simpler and more actionable.
The Minimum Viable Incident Response Plan
Your plan should fit on 2-3 pages and answer these questions:
Who decides?
Name the person who declares an incident and authorizes response actions. This is typically a senior technical leader. Name a backup.
How do we detect?
List your monitoring tools and alerting channels. Where would you notice something wrong? CloudTrail alerts, GuardDuty findings, customer reports, failed login notifications?
How do we contain?
For common scenarios, document the containment steps:
- Compromised IAM credentials: Disable the access key, rotate credentials, review CloudTrail
- Ransomware: Isolate affected systems, preserve evidence, do not pay
- Data exposure: Identify scope, revoke access, assess notification requirements
- Phishing: Reset compromised credentials, scan for additional compromise
Who do we call?
Have a contact list ready:
- Cyber insurance carrier (they often provide incident response resources)
- Legal counsel
- External incident response firm (establish a relationship before you need them)
- Law enforcement contact (FBI IC3 for cyber incidents)
How do we communicate?
Define who communicates what to whom: internal stakeholders, customers, regulators, media. Have draft templates ready.
Test It
A plan you've never tested is a plan that won't work. Run a tabletop exercise once a year — gather your key people, present a scenario, and walk through your response. It takes 90 minutes and reveals every gap in your plan.
After the Incident
Every incident is a learning opportunity. After resolution:
- Document what happened, when, and how
- Identify what worked and what didn't
- Update your plan based on lessons learned
- Implement controls to prevent recurrence
The Cost of Not Planning
Without a plan, incidents take longer to resolve, cost more, and cause more damage. The plan itself costs nothing to create. The tabletop exercise costs a couple hours. There's no excuse not to have one.