While cybersecurity incidents, by definition, involve technology, an IRP is not primarily a set of technical directives.