This is a problem with Incident Response “templates”.  I would draw an analogy to a lot of DR plans. It’s only as good as your last test.

http://www.secure-value.com/douglasdavidson/2012/09/what-did-you-do-with-that-incident-response-template-your-cyber-liability-insurer-providedsion.html