Incident response plan for cyberattack