Why your incident response plan needs a runbook, not a policy doc
Most incident response "plans" we’re handed during an audit are policy documents: a description of roles, an escalation chart, and a promise that the team will "assess and contain" the threat. That’s not nothing, but it’s not what actually helps the engineer who gets paged at 2am with an active intrusion.
A runbook is different. It’s a sequence of concrete, executable steps for specific scenarios — the commands to run, the dashboards to check first, who to notify and how, and the decision points where the responder needs to escalate rather than improvise. The difference matters most exactly when people are stressed and time-pressured, which is precisely when a policy document is least useful.
A good runbook for something like "suspected credential compromise" would specify: which logs to pull first and where they live, the exact command or console steps to revoke the credential, how to check what that credential accessed in the relevant window, who needs to be notified within the first 15 minutes, and what "contained" actually means before the team moves to the next phase.
The reason most teams don’t have this isn’t laziness — it’s that runbooks go stale fast if they’re not tested. A runbook written a year ago against infrastructure that’s since migrated to a new cloud provider or a new logging stack can be actively harmful, sending someone down steps that no longer apply during an actual incident.
That’s why we treat incident response runbooks the same way we treat backups: untested, they’re a guess. We run tabletop exercises against the actual current environment on a quarterly cadence, which both keeps the runbook accurate and gives the team muscle memory for the parts that are hardest to improvise under pressure — who to call, what to say to stakeholders, and when to declare the incident over.
If your incident response documentation reads like it was written for an auditor rather than for the person holding the pager, it’s worth rewriting before you need it for real.