A response plan should define clear roles, responsibilities and escalation paths, provide for the restoration of systems from backups, regulate internal and external communication and include a forensic investigation to analyze the cause.