Incident Response Plan

Incident response is usually broken into phases — preparation, detection and analysis, containment, eradication, and recovery, followed by a post-incident review — a structure NIST and most other frameworks describe in roughly the same order, because the sequence itself is what keeps a chaotic situation from getting worse through a wrong first move.

A real plan names specific roles and decision authority in advance: who's the incident commander, who communicates with affected clients or regulators, and — for the genuinely hard calls, like whether to pay a ransom or when to notify affected individuals — who has the authority to decide, agreed before the pressure of an active incident, not debated for the first time during one.

For smaller clients, an MSP often becomes the de facto incident response function whether or not that's been formalized — which is exactly why having a written, tested plan (not just a vague assumption that "the contract covers security incidents somehow") is the difference between a coordinated first hour and pure improvisation.