An incident response plan ensures that an incident or breach is resolved or counteracted within the minimum possible time and with the least effect on an organization or its IT systems/environments. Typically, an incident response plan is a formal step-by-step process that is clearly defined within or as part of an organization's disaster recovery or business continuity plan (BCP).

According to the SANS Institute, an incident response plan has six components, as follows:

• Staff and organizational preparation
• Incident identification
• Breach containment
• Problem eradication
• Data recovery and services
• Formation of lessons learned, which are used for future audit requirements