SECAI Core · phase 14 of 15 · noun
Incident response plan
Specific procedures that must be performed if a certain type of event is detected or reported.
The Explain card
- Plain English
- An incident response plan is the documented set of procedures that must be followed when a particular kind of event is detected or reported: who does what, in what order, and who decides.
- Example
- A company's plan for "model produces harmful or leaked content" specifies pulling the model from production, preserving logs, notifying legal, and issuing a pre-approved customer statement within two hours.
- Why it matters
- AI incidents are new, fast and public. Without a plan, teams argue about whether to switch the model off while screenshots spread. With one, the first hour is rehearsed.
- Hook
- Decide now, while calm, so nobody has to decide at two in the morning.
Word knowledge
How the word is built, where it came from, and what it sits beside in memory.
In a sentence
After an AI endpoint exposed private training records, the security team followed its incident response plan to isolate the service and preserve logs.
Why these words
- incident Latin incidens, happening or falling upon modifies response by identifying the kind of occurrence involved
- response Latin responsum, an answer or reply modifies plan by identifying the organized reaction
- plan French plan, a drawing or scheme serves as the head noun of the phrase
Where it came from
- Origin
- Modern English compound combining incident, response, and plan, ultimately drawing on Latin and French roots
- Entered the language
- 20th century
- What changed
- Incident broadened from something that happens to a reportable disruption, response expanded from an answer to coordinated action, and plan shifted from a drawing to an organized course of action.
How it is spelled
- Pattern
- The phrase is written as three separate words.
- Pattern
- Two attributive nouns precede the head noun plan.
Spelled like
- emergency response plan
- disaster recovery plan
- business continuity plan
Broken into chunks
-
incident
- incidence
- incidental
-
response
- respond
- responsive
-
plan
- planned
- planning
What it sits beside
Same subject
- security incident
- containment
- forensic logging
- model rollback
- post-incident review
Same shape
- emergency action plan
- disaster recovery plan
- business continuity plan
security planning documents
- incident response plan
- disaster recovery plan
- business continuity plan
incident management activities
- detection
- containment
- eradication
- recovery
Where it sits in the deck
Phase 14: Incident Response, Evaluation, and Knowledge Bases
When detection fires, teams need structured response plans, scoring frameworks, and curated knowledge bases to triage, measure, and learn from AI security events.
