Incident response plan: an incident response plan, incorporating actions that
may range from immediate restoration of service to partial restoration or
suspension of service, should be documented and subjected to regular testing
and review. There should be a properly trained Computer Incident Response
Team (CIRT).