Same here! Although in the context of "Writing" an IR, writing an incident response policy makes the most sense (but isn't very blog worthy)