How to Build an Incident Management Plan for All Hazards
Incidents of any type can derail your organization. An incident management plan protects your team and maximizes business continuity.
Imagine you’re a security leader at a nationwide company. Hurricane season is in full swing, and a storm is barreling through the Caribbean, projected to hit anywhere between Miami and Washington, DC. But the forecast is constantly shifting, given the storm’s potential to pummel the entire East Coast.
Hurricanes are a perfect example of the complex choices companies face in an emergency. When do you make the call to close and evacuate facilities? Who has the authority to decide? What information do you need to plot a course of action? How do you manage the balance between protecting employees and ensuring business continuity?
Businesses face these choices due to all kinds of incidents (not just hurricanes) on a daily basis. In the face of complex and rapidly emerging threats, you can’t sit back and endlessly debate your options. You need a playbook to collect the right information, respond decisively, and recover quickly. Enter the incident management plan.
We’ll explore the four phases of a robust incident management plan and how continuously improving it can help protect your organization.
Download Our Incident Response Plan Template
What Is an Incident Management Plan?
An incident management plan—also called an incident response plan—is a strategy covering how to prepare for, detect, respond to, and recover from disruptive events. It outlines the roles and responsibilities of key people in an organization and the steps they should take before, during, and after an incident.
Incident management plans will cover steps to take, but they’re not a rigid, prescribed course of action. Effective incident response plans take an all-hazards approach and are flexible enough to deal with foreseeable events and the hazards coming out of left field. Common types of events that incident management plans cover include:
- Physical security incidents
- Workplace injuries
- Equipment failures or disruptions
- Adverse weather such as heavy rain, snow, or extreme heat
- Data breaches, ransomware, or other cyber attacks
- Chemical spills
- Natural disasters such as earthquakes or fires
While incident management plans are adaptable, companies generally use templated response plans for more frequent disruptions. For example, a delivery company in New England would want to have a robust set of scenarios for dealing with snowstorms that impact its operations.
Are incident response plans the same as incident management processes?
Incident management plans and processes both deal with disruptive events, but they have different purposes. An incident management process is a strategic framework for how your company deals with incidents. It includes key roles, resources, policies, and procedures at a high level. For example, your incident management process should include:
- A definition of the key roles on your incident management team, but without identifying who they are
- Company resources for incident response in broad categories, without deciding if they’re warranted for a specific type of incident
- Policies about what methods of communication to use for communicating with employees, but not a breakdown of who to contact
- General guidelines for deciding on response procedures, but no prescribed actions for specific hazards
Incident management plans, on the other hand, are a functional approach to dealing with disruptive hazards. They can be both a component and implementation of an incident management process, but the incident response plan will be focused more on the tactical steps of incident management. Following the examples from above, your incident management plan should include:
- The members of your team who will fill the defined roles on the incident management team
- Criteria for when to use specific resources when an incident occurs
- Instructions on which employees—or groups of employees—and stakeholders to contact during an incident
- Specific actions to deal with the various hazards you identify during the risk assessment phase
Incident Response Plan Activation and Authority
The incident leader is arguably the most critical member of any incident management team. Their ability to make rapid, sound decisions can prevent an event from spiraling into a full-blown crisis.
Every phase of the incident plan involves specialized stakeholders, but the incident management team drives the entire process.
Building your incident management team
Members of the incident management team are usually security leaders, but often with multidisciplinary backgrounds. Given the diverse threats businesses face, incident management leaders need to understand not only the security implications and strategies for crisis management but also the on-the-ground impacts.
Your incident management team will also reflect your organization’s structure and industry. For example, an enterprise SaaS provider will heavily rely on cybersecurity, IT, and networking expertise when assembling its incident response team. It might even have a dedicated computer security incident response team (CSIRT). On the other hand, an energy company operating in high-risk locations around the globe will seek to include military, law enforcement, and foreign affairs partners in its incident leadership.
Key decisions for incident response teams
Part of formulating an incident management plan is deciding when, why, and how to activate the plan. Act too soon, and you can disrupt your business more than necessary. Wait too long, and the impact can balloon.
The following three factors should guide incident management teams:
- Criteria for execution: What events or specific conditions would trigger the incident management plan? For example, if a hurricane is in the forecast, what level of certainty and time-to-impact warrants the plan’s execution?
- Authority to activate: Who decides to execute the plan? In most cases, there should be backup voices of authority in case primary personnel are unavailable, and there should be clear criteria for when to consult backups.
- Notification procedures: Who do you notify when the incident management plan activates, and how? Ensuring you’re reaching the right people with accurate information will accelerate constructive incident handling.
4 Phases of an Effective Incident Management Plan
Corrective actions you take to mitigate a hazard will vary widely, but every incident management plan has four distinct phases. Be sure to maintain thorough documentation throughout each phase of the plan.
Phase 1: Preparing and building resilience
The first phase of an incident management plan covers your steps before any potential event. You’ll focus on understanding the threat landscape, preparing your emergency response team, and building out communication protocols.
Key steps at the point include:
- Define the incident command system: A clear chain of command is essential to the incident response process. Lay out all of the roles and ensure team members understand their responsibilities.
- Perform a risk assessment: A comprehensive risk assessment will reveal the risks most likely to occur or cause the most harm. Your risk management matrix will help prioritize types of security incidents for planning and resource allocation.
- Establish a communications plan: Consider who you must communicate with for any incident and ensure you have current contact information. Clear expectations for communication will help keep team members safe and prevent delays in sharing information.
- Identify resources: What capabilities can your organization use to respond to an incident? Understanding the costs and timelines of deploying resources can help calibrate incident response efforts.
- Develop procedures for key scenarios: Most organizations have a subset of potential incidents that are more likely to occur or have a bigger impact. Focusing on these with predetermined response plans can help accelerate and refine your risk response strategies.
Phase 2: Responding with decisive action
The next phase deals with incident response. But before you can act on an event, you need to detect and understand it.
Incident detection is when you determine you’re either in the midst of an event or about to encounter one. It could be a minor security breach, like realizing someone left a door unlocked five minutes ago, or a serious security incident, such as an active shooter entering your workplace. Regardless of scope, detecting an incident kicks off the active response phase, which includes the following steps:
- Notify stakeholders: Alert your incident management team and any affected employees, clients, or vendors when you’re in the midst of an incident. For more serious events, your plan might also call for notifying senior management to begin preparing for public relations efforts.
- Assess the incident: Collate all available information to understand the current state of events. For example, this could be eyewitness reports, CCTV footage for physical security incidents, or network logs and automated alerts for cybersecurity incidents.
- Deploy and manage resources: Start deploying appropriate resources towards threat mitigation as quickly as possible. As the situation develops, manage the resource levels, either pursuing escalation if a hazard increases or scaling back when you detect eradication of the threat.
- Maintain effective communication: Keep your stakeholders aware of developments impacting them. Employee safety is paramount, but providing thorough updates can help avoid undue stress and anguish as team members wonder what’s happening.
Notifying employees and stakeholders of an incident is obviously critical. However, collecting their feedback can be just as important in many cases.
Ashley Guest, Head of Strategic and Operational Solutions for Trust and Security at Uber, described how vital an effective two-way communication platform is to accelerating incident response. “With the platform, we will send out an alert. It has a survey—one for yes or two for no. Are you safe? Do you need assistance? It’s very important that we enable that two-way communication. We need to know exactly what the challenge is and what the problem is.”
Collecting real-time, on-the-ground information allows you to quickly understand the scope of an incident and calibrate your response accordingly.
Phase 3: Recovering and restoring operations
Once you’ve contained or eliminated a threat, it’s time to turn towards recovery. The next phase of an incident management plan covers a return to normalcy. Depending on the type and scope of the incident, there are a few different aspects to recovery and restoration:
- Monitor ongoing threats: In some cases, there’s no clear end to a threat, and you’ll need to monitor a situation. For example, making sure a fire in building walls is extinguished or checking newly repaired chemical pipes for leaks or failure points.
- Assess damage and identify remediation needs: Examine any impacted areas to understand necessary repairs. When damage is severe enough, prioritizing work can help resume normal business operations in phases to minimize the ongoing effect on business continuity.
- Implement recovery plans: Your emergency response plans should call for steps you can take to work around disruptions or backup systems you can use. As you implement backup plans, ensure the resources and systems have not sustained undetected damage in the initial incident.
- Provide support: In the wake of more serious incidents, providing psychological resources and support will be critical to disaster recovery. This can be anything from bringing emergency counselors on site, giving affected staff time off, or pausing operations entirely.
Phase 4: Documenting and analyzing lessons learned
When you’ve resumed normal operations, it’s time to focus on documentation, analysis, and post-incident activity. Along with the documentation you maintained during the incident, it’s helpful to interview your incident management team and anyone else involved. With their feedback, you can construct an after-action report to share with stakeholders.
There are two critical aspects to analyzing an incident. First, you want to assess prevention and preparation by asking questions like:
- What was the root cause of the incident?
- Was there a vulnerability you were unaware of?
- Did you misunderstand the likelihood of the hazard?
- Was the threat more or less impactful than you predicted?
- Did the resources in place match your expectations?
- Were there any gaps in roles or responsibilities that allowed the incident to happen?
- Did any policy failures contribute to the incident?
- Could more robust firewalls or malware prevention tools have helped prevent cyber threats?
Second, it’s important to evaluate the incident management plan’s effectiveness with questions, including:
- Did incident detection efforts succeed?
- Could you better automate incident detection or information collection?
- Should you alter the criteria for activating the incident management plan?
- Were there any gaps in the incident recovery plan?
- Did metrics like time-to-detection and time-to-recovery match expectations?
- Were you able to communicate effectively with all of the key stakeholders?
Based on this data, you can revise and refine your response plan to improve outcomes for future incidents. Incident management is a lifecycle of continuous improvement, and empirical data is the best tool in your arsenal.
Testing and Maintaining Your Incident Response Plan
Incident management plans are living documents that you’ll revisit often. Some key maintenance aspects to consider include:
- Shifts in your company’s operations
- Changes in your workplace, such as new buildings or remodels
- Key additions to or subtractions from your workforce
- Environmental issues altering your threat landscape
Periodic reviews help capture these types of changes. Looking at incident management plans every quarter is generally a good cadence, but more frequent reviews are helpful for more serious threats.
You must also test your incident management plans as you develop and revise them. Using a simulation to depict an incident accurately is not always possible. However, tabletop exercises can capture many key aspects of incident detection and help reveal gaps in your plans. Encourage your team to treat these scenarios seriously, as they can provide key feedback to improve incident response plans.
As a security leader, you hope your team will never have to deal with a serious incident. However, a well-practiced and maintained incident management plan will empower them to protect each other and maintain operational continuity.
