Enterprise Cloud Security and Governance

Preparation

You don't want to be creating an incident response plan in response to an incident. It needs to happen well before an incident occurs.

It is important that the incident response plan is flexible enough to deal with even advanced persistent threats that might occur.

The IRP should also have clear definition related to cross-team contact such as public relations, legal team, IT team, and sharing information on what we might have to respond to.

It is also important to get sign off from the executive management, as without executive management support, the organization might not truly have an incident response process.