5.1. Incident Management Readiness

💡 First Principle: Readiness is built entirely before an incident starts — the plan, the trained team, and the classification scheme that will be used under pressure all have to exist and be rehearsed while things are calm, because none of them can be improvised well in the middle of a crisis.

The feedback arrow is what keeps readiness current. A post-incident finding such as a stale contact list or an unclear authority chain is a readiness gap: it should change the plan, the training and the next exercise, not sit filed in a report.

⚠️ Common Misconception: An incident response plan and a business continuity plan are often treated as the same document. IR focuses on detecting, containing, and eradicating a security incident; BCP focuses on keeping critical business functions running during any disruption — they must be integrated but are distinct plans with different triggers and owners.