Most incident response plans read well. They name a severity scale, an escalation chain and a communications process, and on paper they cover the situations that matter. What they rarely include is any evidence that the organization has actually tried to follow them under time pressure, which is the one condition an incident guarantees.Why a Plan Can Fail Without Being WrongA plan is not usually wrong in what it says — it is incomplete in what it assumes. It assumes the named responders are reachable, that they remember their role without re-reading the document, that the systems needed to execute the plan are not themselves affected by the incident, and that decisions can be made at the pace the plan implies. Every one of those assumptions is exactly the kind that only gets tested by trying, in advance, to actually run the plan.What a Rehearsal Actually FindsA decision-maker who is unreachable at the worst time: and no clearly authorized deputy named to step in — a gap invisible until someone actually tries to reach that person.A communications template written for a scenario that isn't the one occurring: the plan's language rarely survives contact with the specific, messier incident that actually arrives.A dependency on a system the incident itself has taken down: the ticketing tool, the call bridge or the runbook repository living on the very infrastructure that is compromised.A severity threshold nobody can apply in the moment: a scale that reads clearly in a document and turns out to require judgment calls the plan gave no guidance for.“A plan tested only by writing it is a plan tested once, by the person least likely to be surprised by it.”Making the Rehearsal Routine Rather Than RareNone of this requires a full-scale simulation every quarter — a tabletop walkthrough of a plausible scenario, run on a fixed cadence with the actual named responders in the room, surfaces most of these gaps at a fraction of the cost of finding them for the first time during a real incident. The plan on paper is the starting hypothesis. The rehearsal is what turns it into something the organization can actually rely on.Share this articleX (Twitter)LinkedInFacebookCopy Link
Privacy GovernanceJul 17, 2026Where Privacy and Security Stop Being Two TeamsPrivacy and security run as separate functions in most organizations, with separate obligations and separate registers, until a breach requires them to answer as one.
TPRMAug 14, 2026The Vendor Questionnaire Nobody Reads TwiceA security questionnaire completed once at onboarding and never revisited tells you what a vendor's environment looked like on one day — usually not the day that matters.
ISMSJul 31, 2026An ISMS Is a System, Not a BinderISO 27001 certifies an information security management system — an operating system for decisions, not the folder of policies produced to pass the audit that certifies it.
