Top Incident Response Best Practices for 2025

In a high-stakes environment where a security incident is a matter of ‘when’, not ‘if’, the line between a contained issue and a catastrophic breach is drawn by preparation. An ad-hoc, reactive approach to cyber threats is a liability. Organizational resilience hinges on a proactive, well-rehearsed strategy, making a mastery of incident response best practices a non-negotiable core competency for any modern enterprise.

This guide moves beyond generic advice to provide a detailed, actionable roadmap for strengthening your security posture. We will dissect eight critical practices that empower your team to act with precision and confidence under pressure. From creating a foundational incident response plan to mastering post-incident analysis, each step is designed to minimize damage, accelerate recovery, and transform every event into a valuable learning opportunity.

By implementing these strategies, you will learn to:

• Establish a clear command structure for rapid decision-making.
• Enhance visibility across your systems for faster threat detection.
• Refine your team’s skills through realistic simulations and training.
• Leverage advanced tools for testing and validating your response capabilities.

This isn’t just a checklist; it’s a comprehensive framework for building a resilient, adaptable, and highly effective incident response program. Let’s explore the essential practices that will fortify your defenses against the sophisticated threats of today and tomorrow.

1. Develop and Maintain a Comprehensive Incident Response Plan

An Incident Response (IR) plan is the foundational document that guides your organization through the chaos of a security breach. It’s more than a checklist; it’s a comprehensive, actionable playbook that defines roles, responsibilities, communication channels, and step-by-step procedures for handling various security incidents. Without a clear plan, teams react with confusion and improvisation, often making critical mistakes under pressure. A well-structured plan ensures a coordinated, efficient, and effective response, minimizing damage and recovery time. This strategic preparation is a core tenet of modern incident response best practices.

This best practice, heavily promoted by frameworks from NIST and the SANS Institute, transforms incident management from a reactive scramble into a proactive, structured process. For example, after its massive 2013 data breach, Target completely overhauled its IR plan, creating a more robust security framework. Similarly, Equifax’s post-breach recovery involved developing detailed, scenario-specific playbooks to avoid repeating past failures. These examples highlight that a plan is not just about technical steps; it’s about organizational resilience.

How to Implement This Practice

Creating a living, effective IR plan involves several key steps:

• Define Incident Categories: Classify potential incidents (e.g., malware, DDoS, data exfiltration, insider threat) and establish severity levels. This allows for a tailored, proportional response.
• Establish Roles and Responsibilities: Clearly assign roles for the Incident Response Team, including a team lead, technical analysts, legal counsel, and communications personnel. Everyone should know their exact duties when an incident is declared.
• Create Incident-Specific Playbooks: Develop detailed, step-by-step guides for common scenarios. A ransomware playbook will have different steps than a phishing playbook.
• Outline Communication Protocols: Define how, when, and with whom information will be shared. This includes internal stakeholders (IT, legal, executive leadership) and external parties (customers, regulators, law enforcement).

Tips for Success

To ensure your plan remains effective, treat it as a dynamic document.

Key Insight: An incident response plan is not a “set it and forget it” document. It must evolve with your organization and the threat landscape. Regular testing and updates are what make it a truly valuable asset during a crisis.

Review and update the plan at least annually or after any significant security event. Conduct regular tabletop exercises where the team walks through a simulated incident to identify gaps and weaknesses in the plan. Crucially, ensure the plan is stored in multiple, accessible locations, including offline copies, so it’s available even if your primary systems are compromised.

2. Establish a Dedicated Incident Response Team (IRT)

While a plan provides the map, the Incident Response Team (IRT) is the highly skilled crew that navigates it. An IRT is a dedicated group of professionals with pre-assigned roles and responsibilities, poised to take immediate control when a security incident occurs. This team is not just an ad-hoc collection of IT staff; it’s a cross-functional unit designed for rapid mobilization, clear decision-making, and expert-led remediation. Having a pre-established team eliminates the initial chaos of figuring out who does what, ensuring a swift and structured response that is central to effective incident response best practices.

This model, originally popularized by the Computer Emergency Response Team (CERT) framework, is now standard practice in mature organizations. For instance, major financial institutions like JPMorgan Chase maintain large, dedicated cyber incident response teams to protect sensitive financial data. Similarly, tech giants like Google have specialized teams ready to handle everything from platform abuse to sophisticated state-sponsored attacks. These examples prove that a dedicated team provides the institutional knowledge and focused expertise needed to manage complex security crises effectively.

How to Implement This Practice

Building an effective IRT requires thoughtful composition and clear governance:

• Assemble a Cross-Functional Team: Include members beyond technical security. Key roles often include a security analyst, forensics investigator, legal counsel, public relations/communications specialist, and a management representative with decision-making authority.
• Define Clear Roles and Responsibilities: Document the specific duties for each role during an incident lifecycle (detection, analysis, containment, eradication, recovery). Who has the authority to disconnect systems? Who communicates with customers?
• Establish a Chain of Command: Create clear escalation paths. The team needs to know who to report to and who can make critical decisions, especially those with significant business or financial impact.
• Create a Contact Roster: Maintain an up-to-date contact list (including backups) for all team members and key external partners, such as third-party forensics firms or law enforcement.

Tips for Success

A team’s effectiveness depends on its readiness and resilience.

Key Insight: The value of an Incident Response Team isn’t just its technical skill, but its cohesion and preparation. Regular training and drills transform a group of individuals into a coordinated unit that can perform under extreme pressure.

To build a high-performing IRT, ensure you cross-train members on critical functions to avoid single points of failure. Establish a rotating on-call schedule to distribute the workload and prevent burnout. Finally, foster strong relationships with external resources, like specialized incident response retainers from firms like CrowdStrike or FireEye, to augment your team’s capabilities when needed.

3. Implement Comprehensive Logging and Monitoring

Effective incident response is impossible without visibility. Comprehensive logging and monitoring provide the crucial data needed to detect, analyze, and investigate security incidents. This involves collecting logs from across the entire IT infrastructure, including servers, endpoints, applications, and network devices, and centralizing them for real-time analysis. Without this visibility, security teams are essentially flying blind, unable to spot the subtle indicators of compromise that often precede a major breach. This practice is a cornerstone of modern security operations and a critical component of any mature incident response best practices framework.

The value of this practice is demonstrated by the widespread adoption of platforms like Splunk, Microsoft Sentinel, and the open-source ELK Stack (Elasticsearch, Logstash, Kibana). For instance, when the SUNBURST supply chain attack was discovered, organizations with robust logging and monitoring were able to quickly search their historical data for indicators of compromise (IoCs), identify affected systems, and understand the scope of the intrusion far more rapidly than those without. This proactive capability to hunt for threats and investigate anomalies is what separates a resilient organization from an easy target. For a deeper dive into this topic, you can learn more about application monitoring best practices.

How to Implement This Practice

Setting up a powerful logging and monitoring ecosystem involves a multi-layered approach:

• Centralize Log Management: Deploy a Security Information and Event Management (SIEM) or similar platform to aggregate logs from all critical systems. This creates a single source of truth for investigations.
• Deploy Endpoint and Network Sensors: Use Endpoint Detection and Response (EDR) tools, like CrowdStrike Falcon, to monitor activity on workstations and servers. Complement this with network traffic analysis to capture lateral movement.
• Establish Baseline Behavior: Use monitoring tools to understand what normal activity looks like on your network. This makes it significantly easier to detect anomalies that could indicate malicious activity.
• Develop Alerting Rules: Configure your SIEM and monitoring tools to generate alerts for specific, high-fidelity security events. This focuses your team’s attention on the most critical threats.

Tips for Success

To maximize the effectiveness of your logging and monitoring strategy, focus on continuous improvement.

Key Insight: Logs are the digital evidence of a cyberattack. Without complete, accurate, and protected logs, a successful investigation and recovery are nearly impossible. Your monitoring strategy should be treated as a primary security control.

Ensure you are logging security-relevant events, not just operational data. Implement log integrity protection, such as hashing or write-once storage, to prevent attackers from tampering with evidence. Crucially, you must regularly tune your alerting rules to reduce the noise from false positives, which can lead to alert fatigue and cause your team to miss real threats. Finally, make sure the monitoring systems themselves are highly secured and monitored for any signs of compromise.

4. Practice Regular Incident Response Exercises and Training

An incident response plan is only effective if the team knows how to execute it under pressure. Regular exercises and training transform a static document into a dynamic, muscle-memory capability for your team. These drills, ranging from simple discussions to full-blown attack simulations, are where plans are tested, weaknesses are exposed, and skills are sharpened. Just as firefighters constantly train for emergencies, your IR team must regularly practice to ensure a swift, coordinated, and effective response when a real incident occurs. This commitment to readiness is a critical component of modern incident response best practices.

This practice is heavily promoted by institutions like the SANS Institute and is a core component of the NIST Cybersecurity Framework. For instance, the financial services industry regularly conducts large-scale, coordinated exercises like Quantum Dawn to test the sector’s resilience against systemic cyber threats. Similarly, government agencies participate in national drills such as Cyber Storm, which simulate widespread cyber attacks to improve cross-agency and public-private coordination. These examples show that proactive training moves teams from theoretical knowledge to practical, battle-tested competence, ensuring they are prepared for the stress and complexity of a real crisis.

How to Implement This Practice

Building a robust training program involves a multi-layered approach to skill development and procedural validation:

• Conduct Tabletop Exercises: Gather the IR team and key stakeholders to walk through a hypothetical incident scenario verbally. This is a low-cost way to identify gaps in your plan, clarify roles, and test communication protocols.
• Run Simulated Cyber Attacks: Use controlled environments to simulate specific attacks, like a phishing campaign or a ransomware infection. This allows technical responders to practice their hands-on skills in detection, containment, and eradication.
• Engage in Red Team Exercises: Hire an external team (or use an internal one) to act as a real adversary and attempt to breach your defenses. This provides the most realistic test of your people, processes, and technology.
• Provide Ongoing Skills Training: Ensure team members receive continuous education on the latest threat intelligence, forensic techniques, and response tools.

Tips for Success

To maximize the value of your IR exercises, focus on continuous improvement and realism.

Key Insight: Incident response is a performance-based skill. You can’t just read the playbook; you have to practice it until the actions become second nature, especially under the immense pressure of a live attack.

Start with simple scenarios and gradually increase complexity as your team’s maturity grows. Vary the exercises to cover a wide range of threats, from insider data theft to a nation-state attack. Crucially, document the lessons learned from every exercise and use them to update your IR plan, playbooks, and security controls. Involving external partners like legal counsel or law enforcement in relevant drills can also significantly improve real-world coordination.

5. Establish Clear Communication Protocols

During a security incident, communication can either be a powerful tool for control or a catalyst for chaos. Establishing clear communication protocols is a critical incident response best practice that governs how information flows both internally and externally. These protocols define who communicates, what they say, when they say it, and through which channels. Without a predefined communication strategy, organizations risk spreading misinformation, creating internal confusion, damaging stakeholder trust, and mishandling legal and regulatory obligations. A well-orchestrated communication plan ensures a unified, factual, and timely response, preserving the organization’s reputation and operational integrity.

This practice is heavily emphasized by crisis communication experts and regulatory bodies worldwide. The stark contrast between Maersk’s transparent and proactive communication during the 2017 NotPetya attack, which earned them praise, and Equifax’s delayed and confusing disclosures in the same year, which exacerbated public backlash, perfectly illustrates the impact of a communication strategy. Similarly, Colonial Pipeline’s coordinated updates during its 2021 ransomware incident demonstrated the importance of aligning messages for government agencies, industry partners, and the public. A structured approach turns communication into a strategic asset.

How to Implement This Practice

Building a robust communication protocol involves proactive planning and clear delegation:

• Define Internal Communication Paths: Establish secure, out-of-band communication channels (e.g., a dedicated Slack channel, a secure messaging app) that will remain operational even if primary networks are down. Create a clear escalation tree so team members know who to contact and when.
• Establish External Communication Roles: Designate a single, trained spokesperson to manage all external communications. This prevents mixed messages and ensures consistency. Involve legal, PR, and executive teams in crafting these messages.
• Prepare Communication Templates: Draft pre-approved templates for various incident scenarios, including initial customer notifications, regulatory disclosures, press releases, and internal updates. This speeds up response time and reduces errors under pressure.
• Identify Stakeholder Groups: List all potential stakeholders, including employees, customers, investors, regulators, law enforcement, and the media. Tailor communication plans and messages for each distinct audience.

Tips for Success

To make your communication protocols effective in a real crisis, practice and precision are key.

Key Insight: In a security incident, silence is never golden. A proactive, transparent, and consistent communication strategy is your best defense against speculation, reputational damage, and loss of customer trust.

Regularly incorporate communication drills into your tabletop exercises to test your plans. Ensure legal counsel reviews all external-facing messages before they are released to ensure compliance with breach notification laws and to manage liability. Finally, meticulously document all communications sent and received during an incident. This log is invaluable for post-incident reviews, legal proceedings, and demonstrating due diligence to regulators.

6. Implement Proper Evidence Collection and Forensic Procedures

Proper evidence collection and digital forensics are the bedrock of a successful post-incident investigation. These procedures are crucial for understanding the attack’s full scope, supporting potential legal action, and gathering intelligence to prevent future breaches. Without a disciplined approach, critical evidence can be easily contaminated, altered, or destroyed, making it impossible to determine the root cause or hold attackers accountable. This makes establishing forensically sound procedures a non-negotiable component of modern incident response best practices.

This practice is heavily influenced by law enforcement methodologies and has been standardized by digital forensics firms like AccessData and law enforcement agencies such as the FBI. For instance, the FBI’s Regional Computer Forensics Laboratory program relies on strict chain of custody and evidence handling protocols to ensure digital evidence is admissible in court. In the corporate world, enterprises leverage platforms like Cellebrite or Magnet Forensics to conduct internal investigations after an incident, ensuring that every piece of digital evidence is collected and analyzed without compromising its integrity.

How to Implement This Practice

Integrating forensic readiness into your IR plan requires a structured approach:

• Establish Chain of Custody: Create a formal process to document the collection, handling, storage, and transfer of all digital evidence. Every person who touches the evidence must be recorded.
• Use Forensically Sound Tools: Employ specialized software and hardware, such as write-blockers, to create bit-for-bit copies (forensic images) of affected systems. This prevents any modification of the original evidence.
• Preserve Volatile Data: Develop procedures to capture volatile memory (RAM) and network state data from compromised systems before they are shut down, as this information is lost upon reboot.
• Define Evidence Handling Procedures: Create clear guidelines for labeling, storing, and transporting evidence. This includes maintaining environmental controls for physical media and using cryptographic hashing to verify data integrity.

Tips for Success

To ensure your forensic procedures are effective when it matters most, focus on preparation and precision.

Key Insight: Digital evidence is fragile. The first action taken on a compromised system can determine the success or failure of an investigation. Treat every incident as a potential crime scene until proven otherwise.

Start evidence collection immediately upon incident detection to prevent data loss from system overwrites or attacker actions. Maintain meticulous documentation of every step taken, from initial observation to final analysis. For complex incidents, or if litigation is likely, engage qualified forensic specialists early in the process. Finally, always be mindful of legal and privacy requirements related to the data you are collecting and analyzing.

7. Develop Effective Containment and Eradication Strategies

Once an incident is identified, the immediate priority is to stop the bleeding. Containment and eradication are the critical phases where your team actively works to limit the damage and remove the threat from your environment. This involves isolating affected systems to prevent the spread, neutralizing the malicious actor’s access, and methodically eliminating the root cause. A failure in this stage can turn a minor security event into a catastrophic, company-wide breach, making it one of the most vital incident response best practices.

This two-pronged approach is heavily emphasized by endpoint detection and response (EDR) platforms and network security firms. During the WannaCry ransomware outbreak, organizations that quickly executed pre-planned network isolation strategies successfully contained the worm’s spread, while others watched it cripple their entire infrastructure. Similarly, responding to the SolarWinds supply chain attack required a meticulous containment and eradication process, not just patching but completely replacing compromised software and re-securing credentials to ensure the adversary was truly gone. These examples underscore the need for decisive, well-planned actions.

How to Implement This Practice

Effective containment and eradication require a balance between speed, precision, and business continuity.

• Prepare Containment Playbooks: Develop pre-defined strategies for different incident types. For example, a ransomware containment plan might involve disconnecting network segments, while a compromised cloud credential plan would focus on disabling user accounts and rotating all keys.
• Isolate Affected Systems: Disconnect compromised endpoints, servers, or cloud instances from the network. This can be done by disabling network interfaces, applying strict firewall rules, or moving the system to a quarantined virtual LAN (VLAN).
• Eradicate the Threat: This goes beyond just deleting a malicious file. It involves removing all artifacts of the compromise, such as malware, backdoors, and persistence mechanisms. Patching vulnerabilities exploited during the attack is also a crucial step.
• Preserve Evidence: Throughout the process, ensure forensic evidence is collected and preserved. This is critical for post-incident analysis, legal action, and regulatory reporting.

Tips for Success

To execute this phase effectively, preparation and coordination are key.

Key Insight: Containment is not a single action but a strategic decision. The goal is to surgically remove the threat while minimizing operational disruption, which requires clear, pre-approved procedures and a deep understanding of your environment.

Always verify complete eradication before reconnecting systems. A common mistake is to restore from a backup that is also compromised, reintroducing the threat. Coordinate closely with IT operations and business units to manage the impact of containment measures, like taking a critical server offline. Document every action taken during containment and eradication, as this information is invaluable for both recovery and improving your response processes for future incidents. Mastering these steps is fundamental to effective troubleshooting for complex software problems and security threats alike.

8. Conduct Thorough Post-Incident Review and Lessons Learned

The incident isn’t truly over until you learn from it. Post-incident review, often called a “lessons learned” session or postmortem, is a critical phase where the response team and key stakeholders deconstruct the entire event. This process involves a blameless analysis of the incident timeline, the effectiveness of the response actions, and the overall organizational impact. The goal is not to assign blame but to identify systemic weaknesses and process gaps. This practice transforms a reactive, costly event into a valuable opportunity for continuous improvement, strengthening your security posture and incident response capabilities.

This best practice is deeply rooted in the Site Reliability Engineering (SRE) culture popularized by Google, which treats failures as opportunities to build more resilient systems. We see this in action when AWS publishes detailed public post-incident analyses after service outages, providing transparency and sharing key learnings. Similarly, the aviation industry’s rigorous approach to incident investigation has made air travel exceptionally safe. Adopting this mindset is a hallmark of mature incident response best practices, ensuring that each security event makes the organization stronger and better prepared for the future.

How to Implement This Practice

A structured post-incident review ensures that valuable insights are captured and acted upon:

• Establish a Formal Process: Create a standardized template and procedure for conducting post-incident reviews. This should include gathering logs, creating a detailed timeline, and interviewing all involved parties.
• Conduct a Blameless Postmortem Meeting: Bring all relevant stakeholders together, from technical analysts to communication leads, in a meeting focused on process, not people. The primary question should be “What can we do to prevent this from happening again?”
• Generate an Actionable Report: Document the findings in a clear report that outlines the incident summary, root cause analysis, what went well, what could be improved, and specific, measurable recommendations.
• Assign Ownership and Track Recommendations: Every recommendation must have an assigned owner and a deadline. Use a ticketing or project management system to track these action items through to completion, ensuring they don’t get lost.

Tips for Success

To maximize the value of your post-incident reviews, focus on creating a culture of learning.

Key Insight: A post-incident review’s value isn’t in the report itself, but in the implementation of its recommendations. Without follow-through, it’s just a history lesson. True improvement comes from turning insights into action.

Conduct reviews within one to two weeks of incident resolution while memories are still fresh. Ensure the focus remains on improving systems, tools, and processes rather than singling out individual mistakes. Share anonymized findings and key lessons with the broader organization to foster a collective sense of security ownership and awareness.

Incident Response Best Practices Comparison

Item	Implementation Complexity 🔄	Resource Requirements ⚡	Expected Outcomes 📊	Ideal Use Cases 💡	Key Advantages ⭐
Develop and Maintain a Comprehensive Incident Response Plan	High - Requires extensive documentation and regular updates	Moderate - Time investment for development and training	Consistent, coordinated response; reduced incident response time	Organizations needing structured, compliant response guidance	Clear roles and procedures; regulatory compliance
Establish a Dedicated Incident Response Team (IRT)	High - Staffing, training, and coordination needed	High - Skilled personnel and ongoing training	Faster detection and response; expert handling of complex incidents	Large or high-risk organizations with frequent incidents	Specialized expertise; rapid mobilization; continuous improvement
Implement Comprehensive Logging and Monitoring	High - Integration of multiple tools and data sources	High - Storage, compute power, skilled analysts	Early detection; rich forensic data; compliance support	Environments requiring detailed visibility and threat detection	Proactive detection; forensic support; automated responses
Practice Regular Incident Response Exercises and Training	Moderate to High - Planning and recurring execution	Moderate - Time, coordination, training resources	Improved readiness; identifies gaps; boosts team confidence	Organizations seeking to improve preparedness and regulatory adherence	Enhanced coordination; skill maintenance; gap identification
Establish Clear Communication Protocols	Moderate - Development of plans and templates	Low to Moderate - Communication tools and coordination	Timely, accurate info sharing; reputation management	Incidents requiring stakeholder coordination and public communication	Reduces confusion; meets legal notifications; maintains reputation
Implement Proper Evidence Collection and Forensic Procedures	High - Specialized skills and secure processes needed	High - Forensic tools, expertise, and documentation	Accurate incident scope; legal support; prevention insights	Incidents involving legal/regulatory investigations and forensic analysis	Supports legal action; detailed understanding; preserves evidence integrity
Develop Effective Containment and Eradication Strategies	Moderate to High - Technical and process implementation	Moderate to High - Tools, coordination with IT, business impact management	Minimizes impact; stops spread; enables recovery planning	Active incidents requiring rapid containment and mitigation	Prevents spread; minimizes data loss; balances business continuity
Conduct Thorough Post-Incident Review and Lessons Learned	Moderate - Cross-team collaboration and analysis	Moderate - Time and stakeholder involvement	Continuous improvement; identified weaknesses; justifies investments	Organizations aiming for maturity and compliance improvement	Drives security maturity; supports audits; actionable insights

Transforming Your Response from Reactive to Resilient

Navigating the complex landscape of cybersecurity incidents requires more than just a reactive checklist. As we’ve explored, building a truly effective defense mechanism is about weaving a culture of preparedness into the very fabric of your organization. Moving beyond the frantic, ad-hoc scramble during a crisis to a state of calm, controlled execution is the ultimate goal. The incident response best practices detailed in this guide are not isolated tactics; they are interconnected pillars that support a resilient, proactive security posture.

From the foundational necessity of a comprehensive and living Incident Response Plan to the critical importance of a dedicated, well-trained Incident Response Team (IRT), each element builds upon the last. You cannot have effective containment without robust logging, and you cannot learn from mistakes without a thorough post-incident review. These are not merely suggestions; they are the essential components of a modern, mature security program.

From Theory to Action: Your Next Steps

The journey from a reactive to a resilient state begins with an honest assessment of your current capabilities. The most significant takeaway is that incident response is a continuous cycle, not a one-time setup. It demands constant refinement, practice, and adaptation.

To put these principles into practice, consider these immediate, actionable steps:

• Assess and Prioritize: Use the eight best practices outlined as a benchmark. Where are your most significant gaps? Is it the lack of a formal plan, an undefined team, or insufficient training? Identify your top one or two weaknesses and make them your priority for the next quarter.
• Empower Your People: A plan is useless without a team to execute it. Ensure your IRT is not just named but is also empowered with the authority, resources, and training needed to act decisively during a crisis. Foster a no-blame culture during post-incident reviews to encourage honest feedback and genuine learning.
• Simulate and Refine: Don’t wait for a real incident to test your defenses. Schedule regular tabletop exercises and drills. Use these simulations to stress-test your communication protocols, technical procedures, and decision-making processes under pressure. This is where theoretical plans meet practical reality.

The True Value of a Mature Incident Response Program

Mastering these incident response best practices delivers value far beyond just minimizing the financial impact of a breach. A well-oiled incident response machine builds trust with your customers, partners, and stakeholders. It demonstrates a commitment to operational excellence and data stewardship, which in today’s digital economy, is a powerful competitive differentiator.

Ultimately, the goal is not just to survive an incident, but to emerge from it stronger, smarter, and more prepared for the future. By embedding these principles into your operations, you transform incident response from a dreaded emergency procedure into a strategic advantage that safeguards your organization’s reputation, assets, and long-term viability. Your commitment to this continuous cycle of preparation, response, and learning is the single most important investment you can make in your digital resilience.

---

Ready to put these principles into practice? Elevate your incident response testing and post-incident analysis by realistically simulating production traffic with GoReplay. Replay real user scenarios to validate fixes, stress-test your infrastructure, and ensure your team is prepared for anything without impacting your live environment. Visit GoReplay to see how traffic replay can transform your incident readiness.