Use cases
- The organization has a written incident plan that has not been exercised recently.
- Backup systems exist but restoration ownership and testing are unclear.
- Leadership, IT, vendors, legal, and communications responsibilities have not been mapped together.
- A recent security event exposed uncertainty about escalation or recovery.
Review surface
- Incident roles, authority, escalation, and contact paths
- Out-of-band communication options and third-party dependencies
- Backup ownership, restoration expectations, and recovery priorities
- Evidence sources, logging, retention, and basic preservation procedures
- Tabletop scenarios and decision points relevant to the organization
Method
01Identify critical services and likely incident scenarios.
02Map who decides, who responds, and who must be informed.
03Walk through containment, communications, evidence, and recovery decisions.
04Record gaps as operational actions with named owners rather than leaving them as abstract recommendations.
Deliverables
- Readiness findings
- Response-role and escalation recommendations
- Recovery and backup observations
- Tabletop or workflow notes where in scope
- Prioritized readiness action plan
Practice context
Readiness work connects Incident Response & Triage with advisory and risk disciplines because response plans fail as often at authority and handoffs as they do at technical controls.
Illustrative finding — not client data
Area
Recovery readiness
Observation
Backups are reported as available, but no named owner can confirm the last successful restoration test for a critical system.
Consequence
Backup existence may be mistaken for demonstrated recoverability.
Example action
Assign recovery ownership, define restoration objectives, and schedule documented restoration tests for critical services.
Scope
Engagement boundary
Readiness work cannot guarantee a future incident will be contained quickly or recovered without loss. It is designed to reduce uncertainty and expose dependencies before an incident.