Incident response is a technical process by nature, but do you know how to develop and incident response program that’s appropriate for your organization’s level of maturity and get buy in from your business leaders? In this talk I will cover how to determine your organizations maturity by using the capability maturity model and how to implement the PICERL model (prepare, identify contain, eradicate, recover, and lessons learned) to handle an incident. I’ll wrap up the talk by covering how to sell this program to your business leaders and how to prepare a business case to justify it.