Having an incident response retainer, or even a pre-approved external incident response firm, is not the same as being ready […]