Incident Response Preparation and Planning
Preparation is the only phase where you control the clock, and the exam tests whether you can name the artefacts a mature programme produces before an incident ever occurs.
What "prepared" actually means
- An approved incident response policy stating scope, authority, and the team's mandate.
- An IR plan describing the lifecycle, roles, escalation paths, and severity definitions, plus playbooks for specific scenarios (ransomware, business email compromise, insider threat) that a tired analyst can follow at 03:00.
- Pre-authorised actions - for example, permission to isolate a host or disable an account without waiting for a manager - plus defined thresholds for when approval is required.
- Contact and escalation lists held offline, because the responder directory is often the first thing an attacker deletes.
- Out-of-band communication channels (bridged line, separate conferencing tenant, pre-shared call tree) for use when email and chat are suspect.
- Tools and a jump kit: forensic images, write blockers, clean media, loaner laptops, credentials in a vault, and network diagrams current enough to segment traffic.
- Logging and visibility baselines: centralised logs with adequate retention, time synchronisation, EDR coverage, and an asset inventory. You cannot scope what you cannot see.
Exercising, not just writing
Plans decay. Tabletop exercises test decision-making and communications; functional exercises test technical playbooks; full-scale simulations test everything including vendors. Each exercise should produce dated, owned corrective actions tracked to closure.
Worked example
A ransomware playbook exists but has never been rehearsed. During a tabletop, the team discovers that the backup administrator's contact details live only in the email directory, which the scenario has encrypted. The corrective action is not "improve backups" - it is a specific fix: move the escalation list to a printed card and a password vault in a separate identity tenant, assign an owner, and re-test at the next exercise. That granular, dated corrective action is what exam questions reward.
Traps
- Listing tools as "preparation" without policy, authority, or communication arrangements.
- Assuming email and the corporate chat tool will be available during a compromise.
- Writing a plan that names no owner, no approval authority, and no severity thresholds.
- Treating an untested plan as complete.