An incident response plan answers the questions nobody wants to figure out during a crisis. Who is in charge, how systems are isolated, who calls the insurer, lawyer, and IT provider, how clients and regulators are notified, and how evidence is preserved are all decided in advance.
Plans should be short enough to use under pressure, stored somewhere that will be available if systems are down, and rehearsed at least annually. Tax professionals and other regulated businesses may have specific notification duties, which the plan should list.