Incident Response Readiness: Why the Plan Matters Less Than the Practice
Many organizations have an incident response plan. Far fewer have tested whether their people can use it under pressure. Practice is what turns a document into resilience.
Atlantic Fortis · September 24, 2026
Most organizations can produce an incident response plan when asked. It is often a well-structured document, approved and filed. Then a real incident happens, often on a weekend or during a holiday, and the team discovers that the plan assumes people, tools and decisions that are not available in the moment.
A plan is a starting point. Readiness comes from practice.
Where untested plans tend to break
- Contact details and escalation paths are out of date. People change roles, vendors change, and the phone tree nobody has used in two years no longer works.
- Decision rights are unclear. Who can authorize taking a critical system offline? Who speaks to customers, regulators or the media? Who decides whether to engage external specialists or notify insurers?
- Dependencies are assumed. The plan relies on email, a shared drive or an identity system, which may be exactly what the attacker has compromised.
- Backups exist but restoration hasn't been proven. Recovery times are estimated, not tested, and business leaders are surprised by how long restoring a critical service actually takes.
Tabletop exercises: low cost, high value
A tabletop exercise walks a group of decision-makers through a realistic scenario, such as a ransomware attack, a compromised supplier or a data leak, in a facilitated discussion. Nothing is switched off and no systems are touched, yet the gaps surface quickly.
Effective exercises involve both technical and business leaders, use scenarios grounded in the organization's actual risks, and end with a short list of specific improvements with owners and deadlines.
The best time to discover that nobody knows who can authorize a system shutdown is during an exercise, not during an attack.
Building a readiness rhythm
- Review and update the plan at least annually, and after any significant organizational or technology change.
- Run a leadership tabletop exercise at least once a year, and a technical exercise for the response team.
- Test restoration of critical systems from backup, and compare the result with the business's expectations.
- Keep an offline copy of the plan and key contacts, available even if primary systems are unavailable.
- Confirm insurer, legal and forensic support arrangements before they are needed.
The payoff
Organizations that practice respond faster, communicate more clearly and make better decisions under pressure. Just as importantly, they can show customers, insurers, auditors and boards evidence that their resilience has been tested, not just documented.