Most Industrial Control System (ICS) networks require Incident Response (IR) procedures. Generally, these procedures fulfill regulatory requirements and do little to actually prepare the organization for handling an incident. This lecture will concentrate on concepts that decrease required resources for IR, arm responders, and facilitate a return to operations.