The Incident Response Plan in Your Drawer Won’t Save Your Production Line

You have an incident response plan. It’s signed, filed, and probably named in your last insurance renewal. But will it work when it matters?

Chances are you only find out when it’s needed under real pressure, and by then it’s too late.

Most manufacturers we talk to are in the same position:

1. A plan exists. 
2. Almost nobody has tested it. 
3. The line goes down at 2AM, the people named in the document have never sat in a room and walked through their roles, and the plan that looked thorough on paper turns into a guessing game.

A plan is a document. Capability is something you build.

A written plan tells you what should happen. It names an incident commander, lists escalation steps, sets recovery sequences. On the page, it reads like a tested process.

Then a ransomware note hits the controllers running your production line (because manufacturing is the most-targeted sector for ransomware), and the questions the plan never answered start arriving fast. 

• Who has the authority to suspend the line? 
• Who calls the customer whose order just stopped?
• Does the OT side get isolated before or after IT pulls the affected systems? 

The document assumes answers to all of this. It rarely proves them.

This is the gap that decides whether you’re looking at a four-hour incident or a four-week one. Not whether you have a plan, but whether the plan survives contact with a real incident and the people who have to run it.

The gaps stay invisible until the room is under pressure.

Incident response isn’t only a technical job. Your IT team handles detection and containment. But the decisions that shape how the incident plays out sit across the business. Legal owns the disclosure call. Operations owns the customer impact. Your executives own the decision to halt production and absorb the cost.

When those people have never coordinated under pressure, the plan breaks at the seams between them. IT recovers a system that operations needed sequenced differently. Nobody declares the incident for ninety minutes because three people each assumed someone else would. 

The plan covers business continuity and disaster recovery in the abstract, but no one has confirmed which critical processes come back first, or whether your stated recovery times hold up when the pressure is real.

A plan written by one team, for one team, doesn’t expose any of this. It can’t. The gaps live in the handoffs, and a document doesn’t rehearse handoffs.

A tabletop is how you find out before it counts.

A tabletop exercise puts the plan under live pressure without the cost of a real incident. You run a realistic scenario, the people named in the plan make the calls they’d make on the day, and the gaps surface in a room instead of on your production floor.

The scenario has to be real to be useful. A generic “imagine a breach” prompt teaches nobody anything. 

The exercises that work draw on what’s already in your environment: findings from a recent penetration test, weaknesses surfaced by a vulnerability scan, the specific systems your line depends on. 

Test against the threats you’d genuinely face, and the lessons hold. 

Get the right people in the room, too. Technical responders and executive decision-makers both belong in the exercise, so everyone leaves understanding their role and their authority. A response plan only works when the people inside it know what they own before the day they have to own it.

More importantly, this approach builds the buy-in a written plan never earns. When your executives sit through a scenario and watch a gap cost their company in real time, resilience stops being an IT initiative they fund reluctantly and becomes something they understand from the inside.

That’s why we start with readiness, not remediation.

What changes after you’ve tested?

A plan that’s been through a serious tabletop looks different from the one in the drawer. 

• Roles are understood rather than assigned.
• Escalation paths have been walked, so people know who to call and when.
• The plan itself gets rewritten to match how your business runs, because the exercise showed where the document and the reality diverged. 
• The result is a capability you can rely on, not a binder you hope is right.

In manufacturing, the cost of an untested plan shows up at the worst possible moment, when production is down and the clock is running. You don’t want to read your plan for the first time then. You want to know it stands up to reality.

If you want a clear read on whether your incident response would hold up under pressure, try our Resilience Readiness Workshop.

It’s a free, 60-minute session that tells you where your resilience posture stands across six operational dimensions, including where your response planning and testing leave you exposed.

Book a time today, and get a clear picture of where you’d be on the day it counts.