Security incident response plans are usually written for an auditor and discovered to be unusable during the first real incident. The sections that matter are the ones you read in the first hour: who decides, who to call, and what not to touch.
Name the decision-maker and a deputy. The slowest part of most incidents is deciding who is in charge. Name the incident commander role, a deputy, and what happens if neither is reachable within a set time.
Write the notification clocks down. GDPR gives 72 hours from awareness for reportable breaches; insurers and contracts often require notification far sooner. Record each obligation with the trigger, the deadline, and who sends it.
Protect evidence before remediating. The instinct is to reimage and move on, which destroys the information needed to establish scope. Capture memory, logs, and disk images first, and say so in the plan, because nobody will decide this calmly mid-incident.
Here's a preview. Unlock the free download to get all 5 sections (4 more below).
| Role | Primary | Deputy | Responsibilities | First three actions |
|---|---|---|---|---|
| Incident commander | CISO | IT Director | Owns the response; makes containment calls | 1. Declare and timestamp. 2. Open the bridge. 3. Assign roles. |
| Technical lead | Infrastructure Lead | Senior SysAdmin | Investigation and containment execution | 1. Scope affected systems. 2. Preserve evidence. 3. Contain. |
More free templates IT teams use alongside this one.
Most severity matrices fail in the one moment they matter: at 02:00, when a tired engineer has to decide whether to wake anyone. This one is written so the level is readable off customer impact alone: no judgement call about root cause, no guessing how bad it might get.
Incident communication is written badly because it is written under pressure by someone who is also fixing the problem. Pre-written templates with the gaps marked let the first update go out in two minutes rather than forty.
Ransomware recovery differs from ordinary disaster recovery in one decisive way: the environment you restore into may still be compromised. This playbook sequences containment and credential reset before restoration, so you do not recover twice.
Named roles with deputies and first actions, the four phases of preparation, detection and analysis, containment and eradication, and post-incident activity, plus notification obligations with their deadlines and explicit evidence preservation steps.
Because reimaging destroys the information needed to establish scope: what was accessed, how long the intruder was present, whether data left. Without it you cannot answer the questions regulators, insurers, and customers will ask.
Under GDPR, from when you become aware a personal data breach has occurred, not from when the investigation concludes. Contractual and insurance obligations are frequently much shorter, so record each clock separately.
