Over many years of responding and studying how organizations respond to incidents, the material considers many deficiencies and topics that are not fully developed or covered in IR plans. Given advances in technologies from IaaS, PaaS, SaaS, and now FaaS leveraging cloud environment, IR plans must evolve to address these new vectors. This presentation describes advanced environments used in organizations, examines the current threat environment, presents changes in the kill chain, and relates the systemic and business attributes to the IR Plan. The presentation closes with a checklist of items that need to be included in a modern incident response plan.