Today's topic: Creating Actionable Incident Response Playbooks + CIPR Review
1) Last thing on peoples mind is preserving the evidence of what you did so you can show your clients what you did.
2) You can have a 500 page incident response book, but in a crisis, you can only handle short bursts of instructions. Assessment and Evaluation during the event is critical.
3) Incident response - checklists, and it must be implemented and refined, otherwise it is as bad as not having one. Checklist must be consistent and repeatable. It should not be specific.