Could you provide a step-by-step incident response plan template specifically for managing a suspected credential stuffing attack against our customer authentication portal?