Assessing and reviewing the IR plan
The IR plan should regularly be reviewed and assessed to match with the needs of the organization as well as the threat landscape. When assessing the response plan, the following should be evaluated.
Incident assessment and severity criteria: Organizations have to consider whether the criteria used when assessing incidents upon discovery are ideal. Threats constantly evolve and attacks that have been treated with less priority in the past might require urgent attention. Therefore, the criteria of the severity and priority of an incident should be reexamined every once in a while. You should have incident severity levels as a standardized measurement of the impact an incident has on the business, as some assets need to be prioritized based on the impact of downtime and cost to the business.
Escalation: Incidents may be detected at different points; hence, it matters how quickly they can be escalated to the correct personnel. Customer support...
