Incident response plan
The documented procedure for handling a security incident, including roles, decision authority, and contacts.
The plan exists so that decisions are made in advance: who declares an incident, who can authorize taking systems offline, who contacts clients and regulators, and which external help gets called.
It needs to be available when systems are down, which means a copy outside the environment it covers. A plan stored only on the encrypted file server is not a plan.
Where this comes up
Incident response plan sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.