Signs it is time to revisit incident response

This is one of those topics that looks small until it costs you something. A few signals that incident response is due some attention.

Security is a maintenance habit rather than a purchase, which is why it drifts. The teams that stay on top of it are the ones who put it on a calendar rather than a wish list.

The signals

• Nobody can say when it was last reviewed
• The answer depends on who you ask
• Decide who does what before something happens
• Communicating early beats communicating perfectly

Where to start

Write up what happened while it is fresh. The reasoning matters more than the rule, because the rule has exceptions. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

How to tell if yours is fine

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about incident response before you move on:

• Someone can say what the current setup is without going to look
• Decide who does what before something happens — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Most of the value here comes from doing the first two things, not all of them.