Preparation: IR plan, playbooks, tools, training, tabletop exercises, out-of-band communication

Incident response is only as good as the preparation behind it. When an incident strikes, there is no time to decide who is in charge, find the right phone numbers or buy a forensic tool. Preparation is the first phase of the NIST lifecycle, and many exam questions describe a chaotic response and ask what should have been done beforehand. The pieces to know are the IR plan, playbooks, tools, training, exercises and out-of-band communication.