Page 221 - CISSO_Prep_ Guide

review of the plan and the training of new team members. All
key team members should have a succession plan so that another
person can step into their role if they are unavailable. The plan
should be updated with any changes and then distributed to all
key team members. The plan must be available even if the core
information systems of the organization are disabled. Therefore,
paper copies of the plan should be retained offsite.

Summary of Incident Management Planning

The security manager should be prepared to deal with incidents
that may occur. This requires processes to detect, respond,
contain, analyze, eradicate, recover from, and learn from any
incident. Plans should be written so that the organization is
prepared, and the response team is ready.