Incident Response Starts With a Comprehensive Incident Response Plan of Action. A plan is more than a piece of paper in a three-ring binder. It takes an all-encompassing approach to traditional disaster recovery by implementing or formalizing your existing incident response plan. Incident response is top of mind with the Federal Financial Institutions Examination Council (FFIEC), which says, .Institutions should have an effective incident response program outlined in a security policy that prioritizes incidents.”]
Source: https://www.bankinfosecurity.com/if-you-fail-to-plan-a-a-568