5.4Elements of incident response

When an incident actually strikes, the strong organization is one that can act along documents and procedures decided in advance, not by improvisation on the spot. This section covers the differing roles of three document elements—policy (stating the stance), plan (defining preparation and action), and procedure (showing the concrete work)—and the stages and order of the widely referenced NIST SP 800-61 incident-response lifecycle: preparation -> detection/analysis -> containment/eradication/recovery -> post-incident (lessons learned). Getting the order right is this section's biggest aim.

5.4.1The differing roles of policy, plan, and procedure

• Policy is the document stating the organization's high-level intent: "what and why we protect," "what counts as an incident," and "who is responsible." It does not spell out individual methods but sets the overall direction and principles, serving as a management-approved foundation.
• Plan is the document that, following the policy, defines how to prepare, who plays what role, and in what flow to act—the contact structure, role assignments, escalation paths, and needed resources. It is the blueprint for how the organization moves.
• Procedure is the guide that breaks the plan down to concrete task level—the detailed steps the field actually performs, like "when this alert fires, run this command and check in this order." The relationship descends from abstract to concrete: policy -> plan -> procedure.