The basics alone can create adequacy, but to be truly effective, incident response should:
Eliminate grey zones
Document contingencies
Incorporate stakeholder feedback
Be in-line with insurance policies
Plan at a high level
Be tested
Read more.