Incident Response Starts With a Comprehensive Incident Response Plan of Action. A plan is more than a piece of paper in a three-ring binder. It takes an all-encompassing approach to traditional disaster recovery by implementing or formalizing your existing incident response plan. The Federal Financial Institution’s Examination Council says institutions should have an effective incident response program outlined in a security policy that prioritizes incidents, discusses appropriate responses to incidents, and establishes reporting requirements. Adherence to this guidance along with individual agency guidance, says William Henley, Director of IT and Risk Management for the Office of Thrift Supervision.”]
Source: https://www.bankinfosecurity.com/if-you-fail-to-plan-a-568