Free template
Incident Response Plan Template
A fill-in-the-blanks incident response plan built for companies with 50 to 1,000 employees that have a lean IT team, maybe an MSP or SOC, and nobody whose full-time job is incident response. It follows NIST SP 800-61 Rev. 3 and the CSF 2.0 functions, so it holds up in an audit, but it is written for the person who has to use it at 3 a.m. with email down. You get the structure, the tables, and the questions to settle with your insurer and counsel before anything goes wrong.
What's inside
- Roles and contacts with a full RACI table, plus severity levels with clear criteria and response times
- Communication plan covering staff, customers, regulators, law enforcement and your cyber insurer, with ready-to-edit holding statements
- Notification checklist covering state breach laws, SEC 8-K Item 1.05, HIPAA, GDPR and other common rules, with timelines to confirm with counsel
- Playbooks for ransomware, business email compromise, lost devices and vendor breaches, plus an after-action review template and testing schedule
Plan foundations
- Purpose and scope
- Roles and contacts, with a RACI table
- Severity levels (SEV 1 to 4) with response times
Response
- Incident response lifecycle mapped to NIST CSF 2.0
- Communication plan and holding statements
- Evidence handling and chain of custody
- Decision log
Obligations
- Cyber insurance considerations
- Notification requirements checklist
Playbooks and upkeep
- Ransomware
- Business email compromise
- Lost or stolen device
- Third-party or vendor breach
- After-action review
- Testing and maintenance schedule
Get the Word document
Enter your work email and the download unlocks right here. No drip sequence.
Frequently asked questions
What should an incident response plan include?
Who is in charge and how to reach them, how you rate severity, what happens in each phase from detection to recovery, who you must notify and by when, how you preserve evidence, and step-by-step playbooks for the incidents you are most likely to face. This template covers all of them.
Which standard does the template follow?
NIST SP 800-61 Rev. 3 (2025), which organizes incident response around the six NIST Cybersecurity Framework 2.0 functions: Govern, Identify, Protect, Detect, Respond and Recover.
How often should we test the plan?
At least once a year with a tabletop exercise, and after any major change to your systems, team or insurer. The template includes a testing and maintenance schedule.