Preparation and Capability Building
Why preparation is judged on its own
Preparation decides how much of an incident you control. Questions test whether you understand that a signed plan on a shelf is not a capability.
What a mature preparation program contains
- Governance: IR policy, the IR plan, defined authority to declare and escalate, and a RACI that names who decides what.
- Playbooks vs. runbooks: a playbook is a scenario-level decision guide (ransomware, business email compromise, insider data theft); a runbook is the step-by-step technical procedure for a specific tool or check. Questions frequently swap these two.
- People: on-call rotation, a trained incident commander, a scribe, and reachable legal and communications contacts.
- Communications: primary and out-of-band channels - assume email and corporate chat may be compromised - plus call trees and pre-approved holding statements.
- Data and tooling: asset inventory and network diagrams, centralized logging with known retention, EDR coverage, forensic duplication capability, tested offline backups, and a jump kit.
- Third parties: retainer IR firm, forensics lab, cyber insurer contacts, cloud provider escalation paths.
- Exercises: tabletop (discussion-based), functional (partial systems), and full-scale (production-like). Each needs objectives, a scope, and a written after-action report.
Traps
Believing preparation ends when the plan is approved. Running exercises with no objectives or no follow-up. Verifying that backup jobs succeeded instead of verifying that restores work. Forgetting the out-of-band channel. Testing disaster recovery only with IT and no security participation.
Rule of thumb
Every playbook has an owner and a last-tested date. If either is missing, treat the capability as unproven.