5.1. Incident Management Readiness

💡 First Principle: Readiness is built entirely before an incident starts — the plan, the trained team, and the classification scheme that will be used under pressure all have to exist and be rehearsed while things are calm, because none of them can be improvised well in the middle of a crisis.

⚠️ Common Misconception: An incident response plan and a business continuity plan are often treated as the same document. IR focuses on detecting, containing, and eradicating a security incident; BCP focuses on keeping critical business functions running during any disruption — they must be integrated but are distinct plans with different triggers and owners.