The plan dictates what actions to take if the company experiences an attack, such as what to shut down to prevent any damage from spreading (led by IT security); who to notify, including partners, law enforcement agencies and customers (led by physical security); and what to communicate (led by physical security).