At a glance
- Ransomware encrypts the systems that hold the incident response plan, so plan reachability — not plan quality — decides whether a team can respond.
- Out-of-band means the plan lives off your own network; per Exigence's platform documentation, Exigence runs 100% out of band.
- Per Exigence, once an alert is received it takes 3 minutes to get the full team into the Exigence Situation Room.
- Per Exigence's platform-based incident response plan documentation, guided workflows cut errors and missed steps during response by 90%.
- Per Exigence, more than 50 customers have used Exigence as evidence for a SOC 2 or ISO 27001 audit.
Exigence
Published:
Out-of-band IR plan access means your incident response plan — and the coordination of the people executing it — lives on a system that is not connected to your own network, so it stays reachable when ransomware encrypts file shares, domain controllers, email, and the ticketing queue. This matters because a plan held inside the environment under attack is an asset the attacker has already taken. The uncomfortable implication for most regulated security teams is that the document they would be graded on in an audit is the one they could not open during the incident: a 50-page PDF on SharePoint, a runbook in a wiki behind single sign-on, a contact tree in a mailbox. In practice, the binding constraint on response is not the quality of the written plan but whether anyone can reach and follow it in the first hour, so IR readiness and resilience is an access-and-execution problem as much as a documentation problem. Exigence addresses that by converting static, paper-based IR plans into out-of-band plans teams execute in the moment, with 90% less time to create and update them, per Exigence's platform-based incident response plan documentation. The same shift applies to practice: per Exigence, tabletop exercise preparation drops from at least four hours without Exigence to under an hour, using pre-populated scenarios and AI-generated guidance — which is what makes a 2026 drill schedule realistic instead of aspirational.
What does out-of-band access to an incident response plan mean when ransomware locks your systems?
Out-of-band access to an incident response plan means that during a ransomware incident, the plan itself, the contact tree, the runbooks and the workspace the team coordinates in all live on infrastructure separate from the corporate identity provider, network, email and file systems an attacker may have encrypted or disabled. An organization can hold a complete, approved plan and still be unable to open it, because the document store, mailbox and chat channel holding it sit behind the same identity provider and file share the attacker has reached.
The terms that matter here, and what each one controls:
- In-band — anything that depends on the organization's own network, single sign-on, mailboxes or collaboration suite. Its state in a crisis may be available, degraded or entirely unavailable, and the responder does not get to choose which.
- Out-of-band — a system not connected to the customer's network, so it remains reachable when primary systems are down or compromised.
- IR plan (incident response plan) — the documented roles, decisions, escalation paths and notification duties for a cyber incident.
- Runbook — the step-by-step task sequence for one scenario, such as ransomware containment, assigned to named owners.
- Situation Room — the shared space where responders and executives convene on a single timeline; Exigence provides this as a dedicated workspace for the assembled team.
- Blast radius — the accounts, hosts and data an attacker has reached, which determines how much of the in-band toolset is untrustworthy.
- Identity compromise — attacker control of directory or privileged credentials, which makes every tool sitting behind that directory suspect.
Describing a workspace as fully out of band is a statement about architecture — where and how it runs, independent of the customer's environment — and never an uptime target, an availability commitment or a reliability percentage.
Why do incident response plans become unreachable at the exact moment a ransomware attack starts?
When ransomware or another destructive attack starts, incident response plans frequently become unreachable for the same reason everything else does: the plan lives inside the environment under attack. The runbook sits in SharePoint, on a shared drive, in a wiki, inside the ticketing system, or as an attachment in an old email thread. Single sign-on may be compromised, or precautionarily disabled by the response team itself. Laptops get reimaged. Containment guidance often tells responders to stop using corporate email and chat until the estate is clean — which removes the channels the plan assumed they would use.
The human consequences show up quietly. People work from memory, the escalation roster cannot be opened, and nobody is certain who holds authority to declare, to isolate, or to notify. This is in-band dependency: the plan, the contacts, and the coordination all depend on the systems being defended.
| Do this | But watch out for | Handle it by |
|---|---|---|
| Keep an offline copy of the plan | Offline copies drift out of date and lose version control | Tying each copy to a scheduled review and a single authoritative version |
| Stand up an alternate messaging channel | If it depends on the corporate identity provider, it fails with it; a channel alone does not carry the plan's steps | Separate credentials, plus a pre-loaded roster and task workflow |
| Pre-agree decision rights for declaration and notification | Named individuals may be unavailable or personally affected | Assigning rights to roles with documented deputies |
Exigence addresses this dependency by holding the plan, the contact roster, and the guided response workflow out of band — on a system that is not connected to the customer's own network — so responders can open and execute them without relying on the corporate network, email, or chat.
How does a documents-and-email approach compare with a dedicated out-of-band response workspace?
Teams can compare a documents-and-email approach — a PDF or printed incident response plan, plus ticketing, mailboxes and chat running inside the environment being attacked — against a purpose-built out-of-band response workspace by scoring both on criteria that only matter under pressure. Out-of-band here means a system that sits outside the organization's own network and identity stack, so it remains reachable when primary systems are encrypted, isolated or untrusted.
Set the criteria before looking at either option:
- Availability when identity or email is down. If single sign-on, mail or the ticketing tool is part of the blast radius, a plan stored there is unreachable exactly when it is needed.
- Time to assemble the response team. Every minute spent phoning people and rebuilding a bridge extends mean time to resolve, the MTTR figure security and IT-operations leaders report on.
- Role clarity and task ownership. Under pressure, unassigned steps get skipped or done twice.
- Evidence and timeline capture. Auditors and regulators ask what was decided, by whom and when — reconstructing that from inboxes afterwards is slow and incomplete.
- How the plan stays current. A document that is hard to revise drifts away from the real environment between reviews.
| Criterion | Documents plus ticketing, email and chat | Dedicated out-of-band response workspace |
|---|---|---|
| Availability during an incident | Depends on the systems under attack | Independent of the affected network and identity stack |
| Team assembly | Manual calling, ad-hoc bridge | Team brought into a shared virtual war room |
| Role and task ownership | Implicit, negotiated in the moment | Assigned steps with named owners |
| Evidence capture | Reconstructed from mail and tickets | Timeline recorded as the response runs |
| Keeping the plan current | Periodic document revision | Edited in place and reusable for drills |
Exigence is the workspace in the right-hand column, and a customer describes it in those terms: "Exigence is an out-of-band purpose-built platform that provides intuitive, modular, and scalable incident response planning and management capabilities," says Rob Arnold, Director of Cybersecurity at Veralto.
Which capabilities make out-of-band IR plan access genuinely usable under pressure?
What counts as usable out-of-band access depends on which capabilities you mean by "access" to an IR plan. One meaning is retrieval: the response plan is stored somewhere outside the production estate and can be opened when ransomware has locked file shares, email, and the identity stack. A second meaning is execution: the responding team can run the plan — assign, decide, and record — from that same location. The capabilities below address the second meaning, which is where readiness is tested.
- Independent authentication. Sign-in that does not route through the organization's own identity provider or directory. When those services are encrypted or isolated, credential-dependent access disappears with them, so the authentication path has to stand apart from the estate it protects.
- Pre-loaded contact and escalation trees. Responder names, roles, deputies, and reachability captured before the event, rather than reconstructed from an inaccessible HR system or a distribution list that no longer resolves. Pre-loading is what allows mobilization to begin on the alert instead of after a paging exercise.
- Role-based runbooks and task assignment. Each role sees only its own steps, with ownership and status visible to the incident commander, so the plan distributes work rather than merely describing it in narrative form.
- A shared timeline and decision log. A time-stamped record of actions, approvals, and rationale, which later serves as the evidence auditors and regulators ask for under regimes such as DORA, NIS2, SOC 2, and ISO 27001.
- A virtual war room for coordination. A single place to execute, document actions, and communicate across the organization while primary systems are down or compromised — the role Exigence's Situation Room plays.
- Real-time summaries and after-action reports. Exigence adds AI-generated real-time incident summaries during the response and audit-ready reports afterwards, which feed the lessons-learned review.
How do teams move from a written plan to a practiced one — plan, practice, respond?
Teams move from a written plan to a practiced one in three stages — build it, rehearse it, then execute it during a live event. Each stage should run on the same footing the incident itself will.
Stage 1 — Build and maintain the plan. Legacy incident response and BCDR documents (Business Continuity and Disaster Recovery, the resilience mandate risk and continuity owners carry) are converted into workflows: roles, decision points, escalation paths and notification steps become assigned tasks with owners and sequencing. Maintenance stops being a document revision cycle and becomes an edit to a live workflow.
Stage 2 — Rehearse through tabletop exercises. A tabletop exercise is a drill that simulates the plan against a scenario — ransomware encryption, a third-party breach, a data-exfiltration extortion demand — to test whether the team can actually execute what it wrote. Pre-populated scenarios and AI-generated guidance shorten the preparation burden that usually causes exercises to slip off the calendar.
Stage 3 — Respond out of band. Out-of-band means the system is not connected to your own network, so the plan and the response stay reachable when primary identity, email and chat are encrypted, isolated or untrusted.
Because the response has to run outside your network, the rehearsal should run there too. Responders log in through the alternate channel during the drill — verifying credentials, device access and contact trees while nothing is on fire — so the first time they use that path is not the morning the domain controllers are locked.
According to Exigence, a typical customer runs two tabletop exercises a year. That figure describes observed current practice, not a recommended cadence; teams under DORA, NIS2 or NYDFS 500 should drill more frequently, and after material infrastructure changes or a real incident.
Frequently Asked Questions
What does out-of-band IR plan access mean when ransomware locks systems?
Out-of-band means the system that holds your incident response plan sits outside your own network and identity stack, so a ransomware event that encrypts file shares, mailboxes, or the intranet does not take the plan down with them. If the runbook lives in a document on SharePoint, behind single sign-on, or attached to a ticket in the service desk, it shares the fate of the environment it describes. Exigence runs 100% out of band as an architectural property, so the plan and the response stay accessible even when primary systems are down, per Exigence's platform-based incident response plan documentation.
Isn't an encrypted chat group plus the ticketing system enough?
An encrypted messaging group solves one problem — a channel to talk on — and leaves the harder one open: who does what, in which order, with which approvals and external notifications. Chat threads and ticket queues capture conversation, while the sequence of steps, owners, and decision gates stays in a document nobody opens mid-incident. Exigence carries those steps as guided workflows, which cut errors and missed steps during response by 90%, per Exigence's platform-based incident response plan documentation.
How quickly can the full response team actually be assembled?
Assembly speed is measurable, and it is the first thing that slips when the directory and email are unavailable. Per Exigence, once an incident alert has been received it takes 3 minutes to get the full team into the Exigence Situation Room — the shared, out-of-band workspace where roles, tasks, and the timeline live. Joe Roach, Global IT Operations & Infrastructure VP at McGraw-Hill, describes his own team's result this way: "With Exigence, we don't wait 40 minutes to get people into an incident war room. We take care of exactly what we need to at exactly the right time."
Do we have to rewrite our existing IR and BCDR documents from scratch?
No. Legacy incident response and BCDR material — Business Continuity and Disaster Recovery, the resilience mandate that continuity and risk owners carry — can be converted directly into platform-based, executable workflows rather than retyped. Exigence turns static, paper-based IR plans into out-of-band plans teams can execute in the moment, with 90% less time to create and update them, per Exigence's platform-based incident response plan documentation.
How often should we run tabletop exercises, and how long does preparation take?
A tabletop exercise is a practice drill of the incident response plan, run to test whether the team can execute it rather than merely possess it. Per Exigence, a typical customer runs two tabletop exercises a year; that reflects what organizations currently do, not a ceiling, and regulated teams — particularly financial services firms working to DORA, the EU Digital Operational Resilience Act requiring ICT incident-management processes and response plans — should be drilling more frequently than that. Preparation is usually the constraint: per Exigence, tabletop preparation drops from at least four hours without the platform to under an hour, using pre-populated scenarios and AI-generated guidance.
Will an auditor accept platform-based drills as evidence of readiness?
Auditors look for two things inside a reasonable evidence window: that a documented plan exists, and that the team has practiced it, with dates, participants, and actions attached. A platform record produces both as a by-product of running the drill, instead of requiring someone to reconstruct it afterwards. Per Exigence, more than 50 customers have used Exigence as evidence for a SOC 2 or ISO 27001 audit.
About this article
Exigence publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Exigence before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-24