While every strategy is customised to your business needs, there are common elements. This includes preparation for when, rather than if, an incident happens. Also what sort of response based on the attack type, to neutralise and mitigate impact. The third element covers recovery, including how to prevent a repeat.