Incident Response Plan Template

Establish capabilities before incidents occur

• Document incident response team roles and contact info
• Establish communication channels (out-of-band)
• Create incident classification criteria
• Set up logging and monitoring infrastructure
• Conduct tabletop exercises quarterly
• Maintain relationships with IR vendors and legal counsel
• Document critical systems and data locations

Identify and validate security incidents

• Receive alert or report of potential incident
• Validate the incident (false positive check)
• Determine scope and affected systems
• Classify severity level (Critical/High/Medium/Low)
• Assign incident commander
• Begin documentation and timeline
• Notify stakeholders per classification

Limit damage and prevent spread

• Short-term: Isolate affected systems from network
• Preserve evidence (disk images, memory dumps)
• Block malicious IPs/domains at firewall
• Reset compromised credentials
• Disable affected user accounts if needed
• Implement temporary access restrictions
• Document all containment actions taken

Remove threat from environment

• Identify root cause and attack vector
• Remove malware and attacker tools
• Patch exploited vulnerabilities
• Rebuild compromised systems from clean images
• Verify removal with scanning and monitoring
• Update security controls to prevent recurrence

Restore normal operations

• Restore systems from clean backups
• Validate system integrity before reconnection
• Monitor for signs of re-infection
• Gradually restore services with enhanced monitoring
• Verify business operations are functional
• Communicate status to stakeholders

Learn and improve

• Conduct lessons learned meeting
• Document incident timeline and actions
• Identify what worked and what didn't
• Update IR plan based on findings
• Implement security improvements
• Brief leadership and board if required
• File regulatory notifications if required