Incident Response is like Project Management: you have a long list of processes with acronyms and definitions that you are supposed to follow step by step if something happens. Oh, and the process can only be directed by someone certified to do it. You spend a lot of time and energy just to make sure you fill up all the blanks in the process —playing with the tool when you should be fixing the thing.