This is a problem with Incident Response “templates”.  I would draw an analogy to a lot of DR plans. It’s only as good as your last test.

http://www.secure-value.com/douglasdavidson/2012/09/what-did-you-do-with-that-incident-response-template-your-cyber-liability-insurer-providedsion.html

 

Related posts:

  1. Security and Hadoop
  2. Security & Devops
  3. Browser Security
  4. Skills gap in IT security