Write and test an incident response runbook before you need it

Organisations that handle breaches well have one thing in common: they had a plan before the attack. Target had a $1.6 million FireEye security system that detected the breach — and ignored the alerts because there was no clear runbook specifying what to do when the alert fired. An IR runbook documents: who is notified (internal and external), who has authority to make decisions, what systems are isolated first, how communications are handled publicly and with regulators, and what evidence is preserved. The runbook must be tested through tabletop exercises at least annually and updated after every significant incident.