Skip to content
User's blog
About
Home
How It Works
Incident Response Plan Form
Partner
Platform
Privacy
Terms
Step
1
of
6
16%
Plan Overview
Plan Owner Name
First
Last
Plan Owner Role
Last Reviewed
Month
Day
Year
Next Review Date
Month
Day
Year
Version History
Row
Version Number
Change Log
Add Row
Remove Row
Row 1
Version Number
Change Log
Add Row
Remove Row
Scope
Systems
Teams
Incident Types
Geographies
Objectives
Describe Plan Objectives
Critical Assets
Key Systems
Responsible Teams
Team 1
Team 2
Team 3
RTO (in Hours)
RPO (In Hours)
Related Plans
Select All Related Plans
BCP/DR
Crisis Communications
Data Breach Policy
Assumptions and Limitations
Roles and Responsibilities
Incident Commander
Name
First
Last
Phone
After-Hours Contact
Work Email
Personal Email
Responsibilities
Alternate / Backup
First
Last
Phone
Email
Security Lead
Name
First
Last
Phone
After-Hours Contact
Work Email
Personal Email
Responsibilities
Alternate / Backup
First
Last
Phone
Email
Communications Lead
Name
First
Last
Phone
After-Hours Contact
Work Email
Personal Email
Responsibilities
Alternate / Backup
First
Last
Phone
Email
Legal Liaison
Name
First
Last
Phone
After-Hours Contact
Work Email
Personal Email
Responsibilities
Alternate / Backup
First
Last
Phone
Email
Executive Sponsor
Name
First
Last
Phone
After-Hours Contact
Work Email
Personal Email
Responsibilities
Alternate / Backup
First
Last
Phone
Email
Call Tree
Who calls whom, in what order, by severity.
1.
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
2.
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
3.
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
4.
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
5.
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
Incident Classification and Severity Levels
Severity 1
Who Gets Notified
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
How Fast Is the Incident Commander Notified?
How Fast Is the Security Lead Notified?
How Fast Is the Communications Lead Notified?
How Fast Is the Legal Liason Notified?
How Fast Is the Executive Sponsor Notified?
Severity 2
Who Gets Notified
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
How Fast Is the Incident Commander Notified?
How Fast Is the Security Lead Notified?
How Fast Is the Communications Lead Notified?
How Fast Is the Legal Liason Notified?
How Fast Is the Executive Sponsor Notified?
Severity 3
Who Gets Notified
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
How Fast Is the Incident Commander Notified?
How Fast Is the Security Lead Notified?
How Fast Is the Communications Lead Notified?
How Fast Is the Legal Liason Notified?
How Fast Is the Executive Sponsor Notified?
Severity 4
Who Gets Notified
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
How Fast Is the Incident Commander Notified?
How Fast Is the Security Lead Notified?
How Fast Is the Communications Lead Notified?
How Fast Is the Legal Liason Notified?
How Fast Is the Executive Sponsor Notified?
Cross-Reference
Criteria for Moving From Severity 1 to Severity 2
Criteria for Moving From Severity 2 to Severity 3
Criteria for Moving From Severity 3 to Severity 4
Criteria for Moving From Severity 4 to Severity 3
Criteria for Moving From Severity 3 to Severity 2
Criteria for Moving From Severity 2 to Severity 1
Declaration, Activation, and Authority
Reporting Path
Reporting URL
24-Hour Contact
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
Information to Include
Triage Owner
Who reviews reports.
Choose One
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
Target Time to First Look (in Hours)
Declaration Authority
Who can declare an incident at each severity level.
Severity 1
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
Severity 2
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
Severity 3
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
Severity 4
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
Pre-authorized Actions by Severity
Severity 1
Isolate a System
Revoke Access
Disconnect from Network
Engage the IR Firm
Contact Law Enforcement
Notify Customers
Other
Severity 2
Isolate a System
Revoke Access
Disconnect from Network
Engage the IR Firm
Contact Law Enforcement
Notify Customers
Other
Severity 3
Isolate a System
Revoke Access
Disconnect from Network
Engage the IR Firm
Contact Law Enforcement
Notify Customers
Other
Severity 4
Isolate a System
Revoke Access
Disconnect from Network
Engage the IR Firm
Contact Law Enforcement
Notify Customers
Other
Repeater
Row
Please Specify Other for Severity 1
Add Another Action
Remove Action
Row 1
Please Specify Other for Severity 1
Add Another Action
Remove Action
Repeater
Row
Please Specify Other for Severity 1
Add Another Action
Remove Action
Row 1
Please Specify Other for Severity 1
Add Another Action
Remove Action
Repeater
Row
Please Specify Other for Severity 1
Add Another Action
Remove Action
Row 1
Please Specify Other for Severity 1
Add Another Action
Remove Action
Repeater
Row
Please Specify Other for Severity 1
Add Another Action
Remove Action
Row 1
Please Specify Other for Severity 1
Add Another Action
Remove Action
Stand-down Authority and Closure Criteria
Who Declares the Incident Over
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
Required Criteria
Communication Protocols
Internal Communication Plan
External Communication Plan
Channels
Approved Communication Channels
Phone / Text
What’s App
eMail
Out-of-band Channel(s)
Pre-drafted Templates
Holding Statement
Customer Notification
Internal All-hands
Regulator Notice
Spokesperson
Who approves external statements; when legal review is required.
Incident Spokesperson
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
Notification order
notficationorder
Legal, Regulatory, and Insurance Obligations
Puts every clock and every constraint in one place before the incident, so nobody discovers a 72-hour deadline on day three.
Applicable Laws and Regulations
State(s)
Row
State
Applicable State Laws and Statutes
Add Another State
Remove State
Row 1
State
Applicable State Laws and Statutes
Add Another State
Remove State
Countries
Row
Country
Applicable State Laws and Statutes
Add Another Country
Remove Country
Row 1
Country
Applicable State Laws and Statutes
Add Another Country
Remove Country
Trigger
Deadline
Hours
:
Minutes
GDPR
Trigger
Deadline
Hours
:
Minutes
HIPAA
Trigger
Deadline
Hours
:
Minutes
PCI DSS
Trigger
Deadline
Hours
:
Minutes
Sector Rules
Trigger
Deadline
Hours
:
Minutes
Contractual Notification Obligations to Customers and Partners
Row
Contract Name
Window of Time
Hours
:
Minutes
Form of Notice
Add Row
Remove Row
Row 1
Contract Name
Window of Time
Hours
:
Minutes
Form of Notice
Add Row
Remove Row
Public-company Disclosure
Public Disclosure Lead
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
Materiality Determination Process
Privilege Protocol
Pprotocol
Cyber Insurance Requirements
Your Insurance Company
Policy Number
Law Enforcement Engagement
Criteria for Involving Them
Who Decides
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor
What is Shared
Ransom Payment Policy
Pre-decided Position
Sanctions Screening Requirement
Who Can Authorize
Choose One
Incident Commander
Security Lead
Communications Lead
Legal Liaison
Executive Sponsor