• A formal incident response plan defines a response team, roles, escalation, and pre-approved containment actions, with playbooks for common scenarios.
• The plan is independently reviewed and exercised through executive tabletop exercises.
• Incidents are categorized by impact, with reporting and escalation that includes legal.

Framework Alignment: NIST CSF RS.MA, RS.MI; CIS Control 17; GDPR Art. 33, 34; ISO 27001:2022 A.5.24, A.5.26, A.5.27