Incident Response Plan

---

Hi Everyone,
When you are building an incident response plan is it best to include Incident playbooks in the plan? Or better to have the playbooks as separate documents?

For example, if you have an incident category of ‘System Loss or theft’ is it best to include that playbook as an appendix in the response plan document or have it as a separate document?

Thanks,
Art

@Art-Jordan ,

I hope all is well. While there is no "correct" way to approach this, and I have seen clients do juts about everything, there is a common sense approach that tends to work well.

If you divide the plan up into "CORE" and "SUPPORTING" documentary sections, than you can clearly and easily put everything in place and it is orderly and easily referenceable and updates become easy as well, when necessary.

If things are separate, then they have to be found and they may or may not be available and readily accessible when needed in a time of crisis.

Hope that helps...

Good luck !!!

Adam

Thanks Adam that does help, this is my first attempt at creating an incident response plan.