If an incident started right now, would your team know what to do?

Do you have a written incident response plan that says who does what in the first hours of an incident?

Does the plan cover your most likely scenarios specifically (ransomware, a compromised email account, a lost laptop), not just “incidents” in general?

Has the plan been tested in the past year, in a tabletop exercise or a real incident?

Is it clear who leads an incident, and who has the authority to take systems offline or approve emergency spending, at any hour?

Is there an up-to-date contact list for everyone the plan involves, kept somewhere reachable even if your systems are down?

Do you know exactly who you would call for outside help: incident response or forensics support, your cyber insurer’s hotline, legal counsel?

Do you know who you would be obliged to notify (insurer, regulators, affected individuals, customers) and how quickly?

Could your response team communicate if email and chat were down, or couldn’t be trusted because the attacker may be reading them?

Could you reconstruct what happened? Are logs from your key systems collected centrally and retained, with endpoint telemetry to draw on?

Could you contain an incident within minutes: isolate an infected machine from the network and disable a compromised account?