“Incident response plans need to evolve past being a documented procedure. They need to be a working part of any business and the success of the plan should be measured with appropriate metrics—from response time to loss of services and revenue. While this might not always be the case, and the incident may be trivially minor, the potential for a catastrophic incident can happen to any organization.”