Most contractors treat incident response like paperwork. Write a document, file it somewhere, forget it. That works fine until something actually happens at two in the morning and nobody knows who to call. Incident response is one of the areas assessors poke at closely, and it’s usually the weakest part of an otherwise solid program….