No incident response plan, idk what to do

Let me summarize whats been said so far. When you try to change everything at once nothing settles.

Of course, it varies if your situation is different.

I went through the same thing.

Absolutely. If I were to add anything: Start with a small trial; don't commit to everything at once.

Here's how it went for us. When making decisions, write down the worst-case scenario too, not just the best.

When making a decision, first look at what data you have on hand.

I'd say don't rush. Taking measures without an inventory leaves doors you haven't seen open.

I'm also curious if anyone does it differently.

I'll try it.

There's a trap here, let me mention it. Everything goes well for the first three months; problems arise in the fourth.

Payment information changes are never verified through the channel they came from.

The most overlooked point about incident response plan is this: When making decisions write down the worst-case scenario too not just the best.

People defend habits, not processes. Resistance comes from there.

Good call starting this thread.

Correct. Most incidents start with a leaked password, not a vulnerability.

The answer varies greatly by industry; there is no one-size-fits-all rule. If I were you, I'd go this route.

Correct.

I'm curious too.

There's also a measurement aspect to this. Taking measures without an inventory leaves doors you haven't seen open.

That's all, sorry if I went on too long.

correct. most time wase accumulates in tasks waiting for approval.

if you have questions write them; I'll answer as best I can.

I'm a small business, let me explain from my side. Everyone rushing into incident response plan gets stuck at the same point.

Any unwritten clause becomes a point of disagreement later, as both sides remember it differently. Good luck with that.

We've heard this a lot, but it never happened like that for us. Processes without records never improve, because you don't know what to fix.

If I were you, I'd go this route.

I was thinking the same thing... like everyone rushing into incident response plan gets stuck at the same point.

Good luck with that.

We've heard this a lot but it never happened like that for us. Hasty decisions become decisions you have to fix six months later.

When making a decision, first look at what data you have on hand. This is my opinion I'm not claiming it's absolute truth.