Decide who decides
A usable data breach incident response plan names people rather than departments. Someone has to be able to declare an incident, someone has to authorize taking a system offline or spending money on outside help, and one person should be the only voice speaking to customers, regulators, and press. Each of those roles needs a named alternate, because incidents do not wait for anyone to come back from vacation. The plan should also say how this group reaches one another when company email and chat are the very things in question. We have watched capable teams stall while nobody could establish who was allowed to approve an outside engagement. Writing the names down in advance is what prevents that particular delay.
Know your data and your vendors in advance
Most organizations discover mid-incident that they do not actually know where their data sits. Building a current picture of what you hold, which systems and which vendors hold it, and which of it is sensitive is slow work that cannot be done under pressure. Contracts deserve the same treatment: agreements with business customers and with your own service providers often place obligations on you that nobody reads until the day they matter, and cyber policies frequently require particular steps and particular approvals before costs are incurred. Read those while you have the time to read them properly. Keep the policy, the coverage contacts, and the vendor list somewhere that does not depend on your own network being available. A copy nobody can reach is the same as no copy at all.
Choose your responders, then rehearse
Pick the outside forensic firm and the counsel you would call before you need them, and put engagement terms in place ahead of time where you can, since retaining a stranger during an active incident is slow and expensive. Keep those contacts on paper as well as in a phone, since the phone may be one of the things you have stopped trusting. Then exercise the plan: walk a realistic scenario through with the actual people who would be doing the work, and treat every point where the group hesitates as something to fix in the document. A plan that has never been tested is usually being read for the first time by people who are already exhausted. We are glad to sit in on that exercise rather than meet you during the real thing.
