Insights · Template
Incident response plan template
Most response plans are documents nobody can run at two in the morning. This template lists the sections a usable plan needs, who owns each and the evidence that it has been completed and exercised.
How to use it
Before the first step.
- Keep the plan short enough to read during an incident; put detail in runbooks.
- Exercise it with a tabletop before relying on it.
Steps
Each one owned and evidenced.
| # | Step | Owner | Evidence |
|---|---|---|---|
| 01 | Purpose, scope and definitions: what counts as an incident and what severity levels mean. | Security lead | Approved definitions |
| 02 | Roles and contact list: incident lead, deputies, technical, legal, communications, executive, with out-of-hours contacts. | Security lead | Contact list verified quarterly |
| 03 | Decision authority: who can isolate systems, shut down operations, engage external parties, approve payments or notifications. | Executive sponsor | Signed authority matrix |
| 04 | External parties: counsel, forensic firm, insurer, law enforcement, regulators, with contracts and contact routes in place before an incident. | Security lead with counsel | Retainer and contact records |
| 05 | Detection and reporting: how incidents are reported internally and triaged. | Security lead | Reporting procedure |
| 06 | Escalation: severity-based escalation steps and timelines. | Security lead | Escalation table |
| 07 | Containment playbooks for the likely scenarios: ransomware, business email compromise, data exposure, lost device. | Security lead | Playbooks |
| 08 | Evidence preservation: what to capture, how, before containment changes anything. | Security lead with counsel | Preservation procedure |
| 09 | Notification obligations: regulators, customers, insurers, contracts, with deadlines and templates. | Counsel with compliance | Obligation register and templates |
| 10 | Communication: internal, customer, public and press holding statements and approval route. | Communications lead | Templates and approval route |
| 11 | Recovery and return to operations: criteria, order, verification. | IT lead | Recovery procedure |
| 12 | Post-incident review: timeline, root cause, control changes, plan updates; exercise schedule. | Security lead | Review template and exercise calendar |
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days