Quick answer: Having an incident response plan and being able to execute it under real conditions are two very different things. A breach readiness assessment evaluates your actual response capability across the plan, playbooks, roles, communications, forensic preparedness, and third-party coordination, before a real incident tests it. It surfaces the gaps that exist between what the plan says and what the organization can actually do.
Key Takeaways
- Most organizations have an incident response plan. Very few have independently validated that it reflects the current organization, current contacts, and current threat landscape.
- The most common gaps are not technical. They are in decision authority, communications approval paths, and third-party relationships that exist in principle but have never been formalized.
- A breach readiness assessment is not a tabletop exercise. It diagnoses whether the underlying capability exists before testing it under simulated pressure.
- Cyber insurance carriers and regulators increasingly expect documented evidence of IR plan testing, defined escalation paths, and forensic readiness, not just a plan document in a folder.
- The first hour of a breach response determines the outcome of the next several weeks. Organizations whose capability has been validated make better decisions under pressure and contain incidents faster.
What Is a Breach Readiness Assessment?
A breach readiness assessment is an independent evaluation of how ready an organization actually is to respond to a cyber incident. It is not a penetration test, which evaluates whether attackers can get in. It is not a tabletop exercise, which puts the response team through a scenario to test how they perform. It is a structured review of the underlying capability that determines how the organization would respond if a breach occurred today.
The assessment evaluates the incident response plan for completeness and currency. It reviews playbooks and runbooks against the most likely incident types the organization faces. It validates that decision authority documented in the plan matches the people who would actually be in the room. It examines communications readiness, forensic preparedness, third-party relationships, recovery capability, and the discipline around lessons-learned from past incidents or exercises.
The output is a prioritized remediation roadmap: a specific, sequenced set of actions the organization needs to take to close the gaps between its documented capability and the capability it would actually need to manage a real incident effectively.
Why Do Most Businesses Overestimate Their Breach Readiness?
The gap between confidence and capability in breach response is well documented. Organizations that have invested in writing an incident response plan typically believe they are reasonably prepared. The plan exists. It has been approved. It is filed somewhere accessible. When a breach readiness assessment examines that plan against current reality, the findings are often significant.
Plans written by people who have since left
Incident response plans are often drafted by a CISO, IT director, or external consultant and then filed. When that person leaves, the plan remains unchanged. The contacts listed in the plan may be former employees. The decision authority documented may reflect a previous organizational structure. The technology environment the plan assumes may have changed substantially. The plan describes a capability the organization no longer has.
Playbooks that cover generic scenarios but not the actual threats
A ransomware playbook that was written before the organization moved to cloud infrastructure may not address the actual systems that would be affected. A business email compromise playbook that does not account for the organization’s current Microsoft 365 configuration will miss the specific steps needed to contain that incident. Playbooks that are not updated as the environment changes become guidance for a different organization.
Decision authority that exists on paper but not in practice
Incident response requires rapid decisions under pressure: when to notify the board, when to engage law enforcement, when to notify customers, whether to pay a ransom demand, when to take systems offline and accept operational disruption. The plan may name specific individuals as decision-makers for each of these choices. In practice, those decisions may be made by different people, or may not be clearly owned by anyone. A breach readiness assessment validates decision authority against the real organization, not the org chart that existed when the plan was written, which is where vCISO leadership often closes the gap.
Third-party relationships discussed but never formalized
Most organizations know they should have a relationship with breach counsel, with their cyber insurance carrier, and with an external forensic response team. Many have discussed these relationships without formalizing them. When an incident occurs, the first call goes to a lawyer the general counsel knows personally, the cyber insurance carrier number takes twenty minutes to locate, and the forensic response firm is contacted for the first time under crisis conditions. Pre-established, contractually documented relationships with defined engagement procedures are a specific component of breach readiness that assessments regularly find missing.
What Does the Assessment Actually Examine?
A breach readiness assessment covers nine capability domains across the full incident response lifecycle.
The incident response plan is reviewed for completeness against leading IR standards including NIST SP 800-61, ISO 27035, and CIS Controls v8. Playbooks and runbooks are inventoried against the most likely incident types: ransomware, business email compromise, data exposure, insider threat, third-party breach, and cloud account compromise. Roles and decision authority are validated against the actual organization through stakeholder workshops, not just document review.
Communications readiness covers internal notifications, customer and partner communications, regulator notification procedures, media holding statements, and the approval paths for external messaging under pressure. Forensic preparedness examines log retention, evidence preservation, chain-of-custody discipline, and forensic acquisition capability, the same signal-quality that a managed SOC depends on. Third-party coordination reviews pre-established relationships and contract readiness across breach counsel, cyber insurance carrier, external forensic responders, and communications support.
Recovery capability assesses backup integrity, restoration procedures, business continuity activation, and ransom negotiation decision frameworks. Governance and board escalation reviews notification thresholds, briefing materials, and executive update cadence. Post-incident improvement examines the lessons-learned discipline from past events and exercises and the feedback loop into plan and playbook updates.
What Happens After the Assessment?
The assessment produces a Breach Readiness Assessment Report covering current-state capability across all nine domains, with maturity scoring, workshop evidence, and prioritized recommendations. The remediation roadmap sequences fixes by impact and effort. Quick wins, updating contact details, formalizing breach counsel and carrier relationships, drafting pre-approved communications templates, are separated from longer-term initiatives like IR plan rebuilds and playbook expansion programs.
Across the 260+ organizations Armour protects in 52+ industries, the first hour of an incident is lost to the same two things far more often than to any technical failure: reaching someone with real decision authority, and confirming who is actually allowed to take a system offline.
Many organizations execute the roadmap with internal teams. Others engage Armour for follow-on work: incident response plan development, playbook creation, cyber simulation exercises to validate the remediated capability, or an incident response retainer so the team that helped build the capability is also available to respond when an event occurs. To learn how the assessment is structured and what it covers, visit our breach readiness assessment service page.
A breach readiness assessment rarely stands alone. It sits at the front of Armour’s managed cybersecurity services, ahead of breach response when an event occurs, technical forensics for evidence and root cause, cyber simulation exercises to validate the remediated capability, and it feeds directly into cyber insurance advisory and compliance readiness.
The Bottom Line
A plan in a folder is not a capability. The organizations that come through a breach well are the ones that found the gap between their documented plan and their real response capability before an attacker did, not during the worst week of the year. A breach readiness assessment is how you find that gap while you still have time to close it. Book a scoping call to see how the assessment would apply to your organization.
Frequently Asked Questions
How is a breach readiness assessment different from a tabletop exercise?
A: A tabletop exercise tests how the response team performs under a simulated incident scenario, assuming the underlying capability is in place. A breach readiness assessment evaluates whether that underlying capability is actually there: whether the plan is current, playbooks are documented, roles and decision authority match the real organization, and third-party relationships are established. Tabletops validate; readiness assessments diagnose. Most organizations run the readiness assessment first to identify and close gaps, then use a tabletop to validate the improved capability.
How long does a breach readiness assessment take?
A: A standard engagement runs three to four weeks from kickoff to final report. The first week covers scoping and document review. Weeks two and three involve structured workshops with executive, IT, legal and privacy, communications, and operations teams. Week four covers analysis, report drafting, and the executive readout. Larger or multi-entity organizations scale the timeline proportionally.
Do we need a formal incident response plan before the assessment?
A: No. Many organizations engage a breach readiness assessment precisely because they are not sure what they have. The assessment reviews whatever documentation exists and identifies gaps against the standards it needs to meet. Where plans, playbooks, or procedures do not exist, the assessment documents the gap and the remediation roadmap includes developing the missing artifacts. It is equally useful for mature programs seeking independent validation and for organizations starting from a limited base.
What evidence does the assessment produce for cyber insurance purposes?
A: The Breach Readiness Assessment Report is structured to satisfy underwriter expectations on incident response capability. Carriers increasingly require documented evidence of IR plan testing, defined roles and escalation paths, third-party coordination arrangements, and forensic readiness. The report is suitable for direct submission alongside underwriting questionnaires and renewal documentation, and the remediation roadmap demonstrates that identified gaps are being actively addressed.
Can the assessment be scoped to specific areas rather than all nine domains?
A: Yes. It can be scoped to specific capability domains based on the organization’s priorities and the driver for the engagement. Common scoped engagements cover IR plan gap analysis only, playbook and runbook review, communications readiness review, or forensic preparedness assessment. Many organizations start with a scoped engagement focused on the areas their cyber insurance carrier has specifically asked about, then expand to the full assessment in a later phase.
About the Author
David Chernitzky is the CEO and Co-Founder of Armour Cybersecurity, a Toronto-based firm that protects organizations across North America from advanced cyber threats. He brings more than 25 years of cybersecurity and military cyber intelligence experience, having served as an officer in an elite technology unit before co-founding Armour. Armour’s team of military-intelligence veterans and senior advisors serves 260+ clients across 52+ industries with a 97% client retention rate.
