What it asks for. This control asks organisations to build and maintain an incident response capability, including policies, plans, procedures, defined roles, training and communications, to prepare for, detect and quickly respond to an attack.
In practice. There is a documented plan with named roles and deputies, contact details for internal and external parties such as legal, insurers, regulators and law enforcement, and a clear mechanism for staff to report incidents. Exercises such as tabletop scenarios are held regularly and post incident reviews lead to tracked improvements. Evidence includes the plan, contact lists, exercise reports and lessons learned records.
Common gaps. Plans are often written but never exercised, and contact lists go out of date. Regulatory notification duties and decision authority during a crisis are frequently unclear until an incident actually happens.