The company’s incident-response plan needs to be updated. That’s normal — no plan is carved in stone. …