Cybersecurity breaches have become a common occurrence, with the potential to cause significant financial and reputational damage to businesses across all industries. Financial services is one of the most frequently targeted industries by threat actors, so it's essential for credit unions to have a solid incident response (IR) plan in place to mitigate the impact of a breach. It's important to understand how building resiliency into IR plans can help ensure effective, efficient and consistent action to address an incident.

The Cybersecurity and Infrastructure Security Agency (CISA) defines an IR plan as, "A written document, formally approved by the senior leadership team, that helps your organization before, during and after a confirmed or suspected security incident."  Another definition describes it as "… a documented set of procedures designed to guide an organization's response to a cybersecurity incident. It outlines the steps to be taken in the event of a security breach, including how to detect, analyze, contain, eradicate and recover from the incident. The plan typically includes roles and responsibilities, communication protocols, escalation procedures, and a framework for evaluating and improving the response process." Both of these definitions are on point, but a simpler, more easily understood and equally correct definition is "a documented process that is in place as a reference to guide you through steps for responding to a major incident(s) in your organization. IR plans are important because they provide for consistent and uninterrupted actions during an incident. This helps to enable rapid and precise responses in the most high-stress situations and aids continuity in recovery.