The 10-Second Incident Response Plan Audit

Key takeaways

• The test is 10 seconds, from the plan, without a meeting. Pass means the plan holder answers from the document, immediately. "I think so, let me check" and "that is really legal's page" are both fails, and both are findings about the plan.
• A "don't know" is a finding, not a failure to remember. The plan's job is to survive the moment; the holder's memory is not part of the system being audited. If the answer takes longer than 10 seconds, the plan failed that question, not the person.
• The groups mirror the plan's own structure. Command, contacts, clocks, evidence, communications, outside resources, practice: the ten sections every plan needs, turned into questions. A group that fails together tells you which section to rewrite first.
• The frameworks set the standard. NIST SP 800-61 places exercises in the preparation phase and closes its lifecycle with lessons learned that feed back into the plan. FEMA ICS requires command designated in advance. Both test the same thing this audit tests: whether the decisions were made before the incident.

Command and authority (questions 1 to 4)

FEMA's Incident Command System runs on one rule this group tests: command is one named person, designated in advance, with written transfer when it changes. A plan that cannot produce the name in 10 seconds has failed the principle before any incident starts.

1. Who is the incident commander?

A passing plan answers: a name, not a title. "The CISO or their designee" is a meeting scheduled for the worst possible hour.

1. Who are the two deputies?

A passing plan answers: two named people who can take command when the IC is unreachable, asleep, or the subject of the incident.

1. What may the IC spend and decide alone?

A passing plan answers: a stated list of pre-approved calls: isolate a segment, engage the retainer firm, call counsel, brief the board, spend up to a stated amount without asking anyone.

1. When does command transfer?

A passing plan answers: the trigger conditions and the mechanism, a written handoff with a briefing. One commander at a time, every time.

Contact and escalation (questions 5 to 7)

The first-call order comes from the breach response checklist: carrier hotline, counsel, retainer firm. The plan's job is to make that order findable in the dark.

1. What are the first three calls, in order?

A passing plan answers: hotline, counsel, retainer, in that order, with one line on why the order exists: panel rules and privilege both depend on the sequence.

1. When was the contact tree last verified?

A passing plan answers: a date and a named verifier. A tree that survived two reorgs unverified is a list of former colleagues.

1. Where is the carrier hotline number?

A passing plan answers: on the plan's first page, or on the printed copy of it. Three clicks into an intranet is a fail.

Clocks and notification (questions 8 to 11)

Every notification clock starts at discovery, not confirmation, so the calendar work has to be done before hour one. That work lives in the notification matrix, one of the ten sections the plan must hold.

1. Where does the notification matrix live?

A passing plan answers: a stated page or annex, deadlines by law and data type, ready to read, not to rebuild.

1. Which clocks apply to you?

A passing plan answers: the regimes named for your actual data and listing status: GDPR's 72 hours, HIPAA's 60 days, the state breach notification laws layer, SEC disclosure if listed, contractual notice clauses on top.

1. Who forms the notification decision?

A passing plan answers: a named decision group with counsel in it, and a documented risk-of-harm assessment where the law allows deferral. A committee that forms itself at hour 30 is the fail.

1. Who signs off the notification letters?

A passing plan answers: counsel, named, before anything leaves. Notification content is a legal document, not a marketing draft.

Evidence and privilege (questions 12 to 14)

Evidence handling is where plans go quiet, and it is the most expensive quiet. The costliest mistake in incident response is destroying what the machines know before forensics can read it.

1. What is never done before forensics?

A passing plan answers: the prohibitions in one place: no reimage, no power-off where isolation works, no restore from backup, no deleting the attacker's files or notes. Each of those destroys evidence the insurer and the regulator will both ask for.

1. Under whose direction does response run?

A passing plan answers: counsel directs, forensics are engaged through counsel, reports are addressed to counsel. If the plan treats counsel as a courtesy call, the privilege structure gets improvised at 2am, which is when it is weakest.

1. What gets logged, and where?

A passing plan answers: one incident log, every action and decision with a time, a named keeper, a stated location. That log becomes the notification record, the insurance claim, and the review.

Communications (questions 15 to 17)

The communications track runs parallel to the technical one, and it is where a contained incident becomes a public one. The plan's comms section is the only part of the plan that speaks.

1. Who is the one authorized voice?

A passing plan answers: one named spokesperson, and everyone else refers. The crisis communications rule is one voice, zero speculation, and it fails first when the plan leaves the voice unnamed.

1. Who drafts the holding statement?

A passing plan answers: a named owner, with counsel-approved language already in the plan. "We are investigating and will update" is a complete statement, and it can be written today.

1. Where do the pre-drafted letters live?

A passing plan answers: in an annex, counsel-approved skeletons per audience, individuals, attorneys general, regulators, waiting for confirmed facts to fill the slots.

Outside resources (questions 18 to 20)

The outside-resources section is the most-skipped part of any plan, and the part that turns a 2am panic into a 2am phone call. Names, terms, invocation.

1. Which response firms, under what terms?

A passing plan answers: firms by name, with engagement or retainer terms stated. The plan's first call should start work, not a buying chat.

1. Who can invoke them?

A passing plan answers: a named role with the power to invoke without further approval. If invoking the retainer needs a procurement process, the finding is the procurement process.

1. Where are the panel pre-approval rules?

A passing plan answers: your named firms' panel status for your carrier, and the off-panel pre-approval requirement, written down. Learning panel rules during the incident costs hours you have already counted against a clock.

Practice and review (questions 21 to 23)

NIST SP 800-61 places exercises in the preparation phase and ends its lifecycle with lessons learned that feed back into the plan: a tested plan is the deliverable, a written plan is the draft. This group tests whether the plan has ever met reality.

1. When was the plan last exercised?

A passing plan answers: a date, and a tabletop exercise counts. A plan never tested is paper with a cover page.

1. When was it last updated?

A passing plan answers: after the last exercise, the last incident, the last reorg, the last carrier or firm change. Once a year is the floor, not the standard.

1. Where do the last review's findings live?

A passing plan answers: a gap list with owners and dates, and visible changes to the plan that followed it. The post-incident review that feeds nothing was a meeting.

How to score it

Scoring is pass or fail per question, no partial credit.

• Pass: the holder answers, from the plan, correctly, in under 10 seconds. Looking it up is allowed; that is the point. Ten seconds is enough to open the plan to the right page and read a name. It is not enough to reconstruct a decision that was never written down.
• Fail: everything else, including "I think so, let me check," "that is really legal's page," and the honest "I don't know."
• A "don't know" is a finding, not a failure to remember. The audit tests the plan, not the person. The plan's whole job is to be findable in the moment when memory is at its worst. Write each "don't know" down exactly as it was said; the shape of the answer is the gap list.

Count the fails per group, and the group with the most fails is the section to rewrite first. Fails in command and contact cost the most: they slow hour one, and hour one is where evidence, privilege, and the clocks are all decided.

Run the audit with the plan's holder and one witness, questions asked out loud, timed honestly. If the plan fails more than half the questions, it is not a plan yet: rebuild it from the ten-section structure, and until the new one exists, make sure the hour-one moves on the first 24 hours cheat sheet are ones the team can still do from memory. Give every finding an owner and a date, the same gap-list discipline a tabletop uses, and the next audit should run faster than this one.

Frequently asked questions

What counts as a pass on the 10-second test? The question answered correctly, from the plan document, in under 10 seconds, without a meeting or a call. The holder may open the plan and look; finding the answer fast is the skill the plan is supposed to enable, not an admission of weakness.

Our plan has titles everywhere and names nowhere. What does that fail? Questions 1, 2, 15, and 19 outright. Titles are placeholders for meetings; names are decisions made in advance. That is the designated-in-advance principle the Incident Command System is built on, and the reason security teams adopted the role.

How often should we run this audit? Twice a year works for most teams: pair one run with your tabletop and one with a midyear plan review, plus after any reorg, carrier change, or response-firm change. The audit itself takes about twenty minutes with the plan and one witness.

We have no plan to audit. Where do we start? With the template's ten sections, which are the structure this audit's groups follow, then run this audit as the acceptance test. Auditing a blank page is the fastest audit you will ever run, and the least useful. Write first, audit second, and let the first fail list tell you what the second draft owes you.

Free download: the plan this audit tests against, ready to adapt: Incident Response Plan template (DOCX) →