A solid incident response plan is built before you need it. Here's what yours should include, from CSIRT roles to communication templates and tabletop testing.