You should review your security incident response plan annually at a minimum to ensure your business’ security measures are working as designed and are consistent with industry best practices and the pace of technology changes.