At 07:35 on 28 October 2023, the British Library detected a cyber attack. By 09:15 its crisis process was activated, and by 10:00 its Gold Crisis Response Team had convened. On paper, the plan worked flawlessly. The team assembled in under three hours.
They convened by WhatsApp video call, because email was gone. And despite that textbook activation, the Library's catalogue stayed offline for around eleven weeks, and full recovery took eighteen months. The plan survived contact with the incident. The organisation did not, at least not on the timescale the plan implied.
That gap, between a plan that activates correctly and an organisation that actually recovers, is the most important and least discussed problem in incident response. The plan is not the product. The rehearsed recovery is.
"No plan survives contact with the enemy" comes from the 19th-century Prussian strategist Helmuth von Moltke, and it's usually deployed as an excuse for planning less. That's precisely backwards from what Moltke meant. His point was that because the first contact scrambles the plan, the commander needs deep preparation and a repertoire of rehearsed responses to improvise from. Planning matters more, not less.
Eisenhower sharpened it in 1957: "Plans are worthless, but planning is everything," because an emergency is by definition "not going to happen the way you are planning." The document is disposable. The mental rehearsal that produced it, and the people who did the rehearsing, are the asset. An incident response plan that has only ever been written and filed is a document. An IR capability that has been exercised is a muscle. Attackers meet your muscle, not your document.
Look at how the flagship incidents of recent years actually began, and a pattern emerges that no plan template anticipates well.
The British Library was breached through a terminal server with no multi-factor authentication, a risk its own review admits "was identified and raised... but the possible consequences were perhaps under-appraised." Colonial Pipeline fell to a single compromised VPN password on an inactive account with no MFA, and shut down national fuel supply for six days, not because the pipeline was hit but because the billing system was. Change Healthcare was entered through a Citrix portal with no MFA, by its own CEO's Congressional admission, and disrupted roughly a third of US healthcare transactions. MGM Resorts was taken down by a ten-minute phone call to its IT help desk, costing around $100 million.
None of these entered through the front door the plan was written to defend. They came through the overlooked account, the third-party portal, the human on the phone, the "under-appraised" risk. A plan is a set of predictions about how the emergency will unfold, and the emergency's defining feature is that it unfolds differently.
Post-incident reviews keep surfacing the same failure points, and they're almost never the ones the plan spent its pages on.
The communications channel dies first. If your IR plan lives in email, SharePoint, or Teams, and the ransomware has encrypted your environment, your plan is now inside the burning building. The British Library ran its crisis on WhatsApp. Maersk, during NotPetya, ended up flying a hard drive across continents because the recovery data couldn't move any other way, after discovering all 150 of its domain controllers had been wiped and their backups had replicated each other into uselessness. The one surviving controller existed only because a power cut in Ghana had knocked it offline before the malware hit. Recovery hung on an accident.
Backups exist; the restore path doesn't. This is the recurring gut-punch. The British Library had backups and still, in its own words, was "hampered by the lack of viable infrastructure on which to restore" them. A backup you have never rehearsed restoring is a hope, not a control, and Sophos found that in 94% of ransomware cases attackers went after the backups directly, succeeding more than half the time.
And decision authority is ambiguous at 3am. Who is authorised to pull the network, pay a ransom, or call the regulator, and are they reachable? Plans written for a compliance auditor rarely answer that. Plans written for an operator start there.
The evidence for fixing this is not soft. IBM's research found that a tested incident response plan, as opposed to one that merely exists, was associated with breach cost savings measured in the millions of dollars per incident. Yet an earlier IBM study found that among organisations with IR plans, over half didn't test them regularly. The gap between having a plan and rehearsing one is where the money and the downtime live.
Survivable planning, drawn straight from what the failures above teach, looks like this. Rehearse the decisions, not just the document, through tabletop exercises where your actual people make the actual calls under pressure, because the deliverable of planning is humans who have decided before. Establish out-of-band communications, a pre-agreed channel and call tree that survive your primary systems going dark, with printed copies, because a plan you can't open is a plan you don't have. Validate your restore path against a real recovery-time objective by actually restoring, on a schedule, so the first time isn't during the incident. And write the plan for the operator at 3am, not the auditor at renewal, with clear decision authority and a checklist that works when everything else doesn't.
One honest caveat: no amount of exercising will make an incident go to plan. That isn't the goal, and Eisenhower already told us it's impossible. The goal is an organisation full of people who have been here before in rehearsal, so that when the real thing arrives through the paragraph nobody wrote, they improvise from muscle instead of freezing over a binder.
The British Library did a great deal right, and published a braver post-incident review than most organisations ever will. Its hardest lesson is the one every IR plan owner should sit with: the plan can activate perfectly and you can still be down for months, if the plan was the only thing you ever rehearsed.