Free working template
Incident Response Plan
A concise working plan for roles, severity, containment, evidence, communications and recovery.
Incident Response Plan
A concise working plan for roles, severity, containment, evidence, communications and recovery.
- Organisation
- ________________________________
- Owner
- ________________________________
- Version / date
- ________________________________
Scope and authority
Systems covered, incident commander, containment authority and escalation threshold.
Notes / evidence
Critical contacts
Service owner, security lead, legal/privacy contact, communications lead and key suppliers.
Notes / evidence
Response flow
Detect → validate → contain → preserve evidence → eradicate → recover → review.
Notes / evidence
Decision log
Time, decision, owner, reason, evidence and next review point.
Notes / evidence
Recovery acceptance
Service checks, data integrity, security validation and business-owner approval.
Notes / evidence