Policy vs Plan: Are You Prepared For A Cyber Incident?

An effective cyber security framework relies on both an Incident Response Policy and an Incident Response Plan. The policy sets the governance and strategic direction for managing incidents, while the plan provides the practical steps for carrying that direction out. Although the two documents serve different purposes, they are closely connected, and together they give an organisation the governance and operational capability needed to respond effectively to cyber security incidents.

Incident Response Policy: Setting the Strategic Direction

The Incident Response Policy is a high-level, strategic document that defines the organisation's approach to managing cyber security incidents, setting out why incident response matters and what is expected when an incident occurs. It establishes the principles, objectives, governance requirements, and expectations that guide incident response activities across the organisation. It does not prescribe step-by-step procedures; those belong in the Incident Response Plan.

Key components of an Incident Response Policy include:

Scope and Purpose - Defines the types of incidents covered by the policy and explains why a structured incident response capability is required.

Roles and Responsibilities - Assigns strategic accountability for incident response to key stakeholders, including senior management, IT and security teams, business units, and external partners. For example, the policy may name an Incident Response Lead as overall owner, leaving the specific tasks to the Incident Response Plan.

Governance and Compliance - Ensures incident response activities align with applicable legislation, regulatory obligations, contractual requirements, and recognised industry standards.

Objectives - Sets out the goals of incident response, such as:

Minimising operational disruption
Protecting information assets
Reducing business impact
Supporting business continuity and resilience

Continuous Improvement - Promotes a culture of learning and preparedness by requiring the review of incidents, the implementation of improvements that strengthen future response efforts, and appropriate training and awareness for staff.

Incident Response Plan: Delivering the Operational Response

The Incident Response Plan translates the requirements set out in the Incident Response Policy into action. It is a detailed, tactical document that gives responders step-by-step procedures for managing cyber security incidents.

The plan is designed to support the management of a wide range of incidents, including:

Data breaches
Malware and ransomware attacks
System outages
Endpoint security compromises
Other cyber security events

A comprehensive Incident Response Plan should include the following stages, which together cover an incident from first detection through to lessons learned:

Identification - Processes for detecting, validating, and classifying incidents.

Containment - Actions to isolate affected systems, limit damage, and prevent further spread or escalation.

Eradication - Procedures to remove the root cause of the incident and eliminate any malicious presence.

Recovery - Steps to restore systems, services, and business operations safely and efficiently.

Post-Incident Review - Processes for analysing the incident, evaluating the effectiveness of the response, and identifying opportunities for improvement.

A well-developed Incident Response Plan enables organisations to respond quickly and consistently, reducing operational impact and supporting effective remediation. It also looks beyond immediate recovery by promoting informed decision-making that protects business operations, finances, reputation, and stakeholder confidence.

The Policy and Plan Working Together

An effective incident response capability depends on policy and planning working together. The Incident Response Policy defines the "what" and "why", establishing the organisation's strategic direction through its principles, objectives, and expectations for managing cyber security incidents. The Incident Response Plan provides the "how", turning those requirements into practical actions so that the organisation can respond consistently and effectively when an incident occurs.

Accountability shows this handoff most clearly. The policy establishes it by defining roles and responsibilities at a strategic level, for example by assigning overall responsibility to an Incident Response Lead. The plan then translates those responsibilities into specific tasks and procedures, detailing the actions that individual must coordinate during incident detection, containment, recovery, and communication activities. Together, these documents help ensure that response efforts align with organisational objectives, regulatory obligations, and industry best practice.

Both documents support continuous improvement and preparedness. The policy sets the expectation that lessons will be learned from incidents and that staff will receive appropriate training and awareness, the plan puts this into practice through post-incident review processes and clear procedures that personnel can follow during a cyber security event. The procedures only help if people know them, so regular training, testing, and exercising of the plan are essential to ensure teams understand their responsibilities and can respond confidently and effectively when faced with a real-world incident.

How Does Protocol Policy Systems Help Organisations Be Prepared?

Protocol Policy Systems (PPS) provides IR Hub, a repository within Policy Management as a Service (PMaaS) for storing incident response (IR) documentation. Because IR Hub is hosted on PMaaS rather than on an internal site that could be impacted during an incident, customers can still access their IR documentation when they need it most.

PPS provides the following key documents with IR Hub:

Incident Response Plan
Incident Response Report Forms
Incident Response Contact List
A series of Incident Response Playbooks

Having these documents in place is only the first step. To validate readiness, organisations should regularly conduct scenario-based exercises and incident simulations. Regular exercises help transform documented procedures into operational capability, ensuring teams can respond effectively when faced with a real-world cyber security event.

AI Assistant now available for PMaaS

Our October enhancement release introduces support for AI assistants in PMaaS. PMaaS now accepts AI agent connections from Copilot and Claude via MCP service, allowing users to easily find policy content, with links back to the site.