@hacks4pancakes in all honesty, most organizations are too small with too little support to do any of this. It's a real issue, but most of them are looking at it like a fire; if it happens it happens and you let professionals deal with it after the fact.
I'm not saying it's right or good but IT isn't even a job title at most businesses.
If the orgs IR plan isn't much more than the steps needed to halt operations and enact the business continuity plan than that's fine. You just want to avoid flying by the seat of your pants as much as possible in that scenario - should it ever come.
@faffinaboot @mikebabcock this. Look, a plan that lists your retainer contact information, who is in charge, and a first hour’s steps is a plan. I get calls every week from orgs that don’t have this much. Many go out of business. Some are in tears realizing this fact, when IR firms tell them it will be a two week wait to get help with no agreements in place. It’s something that has a cost, but you just can’t afford not to do. It’s like cheaping out on smoke alarms. Something, anything.