A cyber incident response plan is a key element of business security. Having the right measures in place helps minimise disruption to your business in case of data breaches, cyber-attacks, and other security risks. The need is growing: in 2025–26, the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) responded to over 1,500 cyber security incidents, up 20% from the previous year.
But even the most prepared businesses can fall prey to common mistakes. We have outlined three common mistakes in cyber incident response planning that can hinder response efforts, and how you can avoid them.
Failing to test backups
One of the most important ways to protect your organisation against the impact of ransomware attacks is to regularly back up data. But you must also test and review these backups to ensure they work as intended. If not, your business can still suffer prolonged downtime and data loss despite your efforts.
Ransomware remains a real risk for Australian businesses: ASD's ACSC responded to 139 ransomware incidents in 2025–26. Regular backups are one of the mitigation strategies in ASD's Essential Eight, and even at its first maturity level, restoring data, applications and settings from backups is expected to be tested as part of disaster recovery exercises.
If you have cloud backups, test download and restore times to ensure they meet your needs. It’s also important to check that incident response is covered in your contracts with cloud providers — ASD's incident response planning guidance asks whether your agreements with service providers include incident reporting and response activities. This adds extra protection against issues like being unable to access forensic images of servers, emails, and other remote assets.
In cases of targeted attacks with deep malware infections, you may need to restore complete backups of the operating system. Test the restore speed of full system backups frequently to ensure quick recovery when you need it.
Lock Down Your Cybersecurity & Compliance
Protect, Certify & Grow Your Business. Contact us to learn more about our fully managed comprehensive cybersecurity service that helps businesses reduce risk, certify, protect, and build trust. Speak to an expert.
Not having an incident response retainer
Choosing to use an incident response retainer is a practical decision every business must consider. For some companies, recurring expense is not financially feasible. However, it’s important to be aware of the risks involved with not using a retainer.
Firstly, organisations that don’t use an incident response retainer may have to contact multiple security firms during an incident to find one with availability. Cybersecurity firms are in high demand and many will prioritise retainer customers. When a firm with availability has been found, onboarding and preparation will have to happen while the incident is still ongoing and before any action can be taken.
Secondly, without an established service level agreement, you may have to pay a substantially higher hourly rate for incident response services.
Businesses with an incident response retainer have agreed service levels in place and can act fast in times of need, without having to shop around for the right provider and wait in line. This helps your business move on swiftly and minimise the consequences of cyber-attacks. ASD's practitioner guidance also recommends recording the details of any external incident response providers, and the services they provide, in your incident response plan.
No clear chain of command
Part of cyber incident response planning is setting up an internal response team. But many organisations make the mistake of not designating a person to lead the charge. As a result, the speed of response can falter as people are uncertain of their roles and decision-making capacity.
To mitigate this risk, set up an incident response team with the right person who you trust to make major decisions during a breach or crisis. Choose a strong leader to oversee the team and ensure each member has clearly defined roles and responsibilities. Give this team pre-approved authority to respond to incidents as needed, so it doesn’t have to wait on management sign-off and use up precious time.
Be prepared with the right cybersecurity support
Having the right incident response plan in place can turn a data breach into a manageable disruption instead of a serious threat to your business.
We can help you enhance your incident response plan with our Cybersecurity & Compliance Services. Manage your business with peace of mind while our 24x7 Security Operations Centre monitors your environment and supports incident response in times of crisis.
The First Step is Crucial. Start with a Cybersecurity Assessment
Where are you at your cybersecurity maturity journey? Get an assessment of your current security posture and identify the gaps and challenges that you need to act upon. Start an assessment or book a free consultation.
Frequently asked questions
What should a cyber incident response plan include?
A cyber incident response plan should set out the roles, responsibilities and authorities of the people managing an incident, the steps to detect, contain and recover from it, and your legal and regulatory reporting obligations. ASD's guidance also recommends including internal and external communication processes, contact details for third-party providers, and a post-incident review so lessons feed back into the plan.
How often should you test and review an incident response plan?
ASD advises testing your plan regularly and updating it based on what you learn. Its practitioner guidance suggests reviewing the plan on a set schedule, such as bi-annually or annually, and after a cyber incident, an exercise or a significant organisational change. APRA-regulated entities must review and test their information security response plans at least annually under CPS 234.
Who should be on an incident response team?
The team usually includes an incident manager who leads the response, a deputy, technical incident responders who investigate and contain the threat, and a communications or media adviser. Depending on the incident, ASD notes it may also involve system administrators, network engineers, legal advisers, finance and procurement specialists, and record-keeping staff. The make-up of the team will vary with the size of your organisation and its available skills and resources.
What is an incident response playbook?
A playbook is a detailed, step-by-step procedure for responding to a specific type of incident, such as ransomware or a data breach. ASD describes playbooks and standard operating procedures as supplements to your main incident response plan: the plan sets out the overall process and decision-making, while playbooks guide the team through the technical actions for common scenarios.
What is the difference between an incident response plan and a business continuity plan?
An incident response plan focuses on detecting, containing and recovering from a cyber security incident. A business continuity plan keeps critical operations running during any major disruption, cyber or otherwise. ASD recommends that your incident response plan aligns with your emergency, crisis and business continuity arrangements, so the two work together during an incident.
What is an incident response retainer?
An incident response retainer is an agreement with a cyber security provider, set up before an incident, that secures access to their response team on pre-agreed terms. Retainers typically define service levels such as response times, and may include onboarding to your environment in advance, so the provider can start work quickly instead of learning your systems mid-incident.
