Incident Response · July 2026

Building an Incident Response Plan That Actually Works

Hope is not a strategy when ransomware strikes. The difference between a contained, minor disruption and a company-ending disaster usually isn't the sophistication of the attacker — it's whether a documented, rehearsed incident response plan already existed before the alert fired. If your team would be "figuring it out" in the middle of an active breach, you are losing the two things you can't get back: time and trust.

The six phases of incident response

A workable incident response plan doesn't need to be complicated, but it does need to cover each of these stages, with a named person responsible for each one:

1. 1. Preparation

   Backups that are tested (not just scheduled), a documented asset inventory, and a plan that's actually written down — not tribal knowledge in one person's head.

2. 2. Identification

   Recognizing that an incident is happening, and confirming scope before jumping to conclusions.

3. 3. Containment

   Isolating affected systems fast enough to stop lateral spread, without destroying the evidence you'll need later.

4. 4. Eradication

   Removing the actual cause — not just the symptom — so the same attacker can't walk back in through the same door a week later.

5. 5. Recovery

   Restoring systems from verified-clean backups and monitoring closely as operations resume.

6. 6. Lessons learned

   A blame-free review of what happened and what the plan should change — skipped by almost every organization that hasn't been through this before, and the single highest-value step for the organizations that have.

Why a written plan isn't enough on its own

A plan that lives in a document no one has read since it was written is barely better than no plan at all. The gap shows up exactly when it's most expensive: during a live incident, when the people executing the plan realize the escalation contact left the company eight months ago, or that nobody actually has the credentials to the backup system. A tabletop exercise — a structured walkthrough of a simulated incident with your actual team, without touching production systems — is how you find those gaps on a Tuesday afternoon instead of during a real ransomware event at 2 a.m.

What this looks like for a Moroccan SME

You don't need a 24/7 security operations center to have a real incident response capability. What you need is: a plan sized to your actual infrastructure, clear internal ownership of each phase, a pre-agreed relationship with an external responder for when the incident exceeds internal capacity, and at least one rehearsal per year. That combination is realistic for almost any business, and it's the difference between a ransomware attempt costing you a few hours of downtime versus becoming an existential event.