You have an incident – may be a breach in progress, may be a breach that happened a while ago but is just noticed – what is your incident response? What do you do? Do you have a plan? Have you tested your plan recently? Is everyone trained in their responder role?