The plan assumes the wrong person is reading it
Response plans are usually written by the most senior, most experienced person on the security team — and then used, in practice, by whoever is on call when the incident actually starts, who may be far more junior and seeing this specific scenario for the first time.
A plan that only makes sense to its author is not a plan; it's a reference document for someone who didn't need it anyway.
Decision fatigue is the real enemy at 3am
Under stress and at low energy, a long document with many branching decision points is far harder to execute than a short, linear checklist for the first thirty minutes: who to notify, what to contain first, what not to touch yet pending evidence preservation.
Save the nuanced judgement calls for business hours, once the immediate bleeding has stopped — the 3am version of the plan should be short enough to execute from memory under pressure.
Test it the way it will actually be used
Run at least one drill a year that is genuinely unannounced, out of hours, and executed by whoever happens to be on call — not a scheduled daytime tabletop with the usual senior attendees. The gaps this surfaces are uncomfortable and exactly the ones worth finding before a real incident does.
Treat every real incident's post-mortem as a mandatory input to revising the plan; a plan that hasn't changed in two years either had a perfect response record, or nobody is actually updating it.
A plan that only works for the person who wrote it is not a response plan. It is that person's personal notes.MNB Security Practice
Key actions
- Write the first-30-minutes response as a short, linear checklist
- Run at least one genuinely unannounced, out-of-hours drill per year
- Design for the on-call engineer's experience level, not the author's
- Update the plan from every real post-mortem, not on a fixed schedule only