A contingency plan lays down what action is to be taken in the event of a successful attack, who is responsible for what, what data have priority, and who has to be informed, etc. A contingency plan should be drawn up well in advance, since in a real emergency almost no one is going to stay calm. The important thing here is that the contingency plan is made known, and is easy to access.