How to Create an Incident Response Plan (With a Fill-In Outline)

When a cyberattack hits, the worst time to figure out who is in charge is while your files are being encrypted. Who calls the insurance company? Who is allowed to shut down the server? Who talks to customers? Do you even have the bank’s fraud line written down somewhere that is not in the email account that was just hacked?

An incident response plan answers those questions in advance. It does not need to be a 100-page binder. For most small and midsize businesses, a clear 8 to 12 page document, plus a few 1-page playbooks, is enough to cut hours of confusion out of the worst day of the year.

This guide gives you a fill-in outline you can copy, explains each section and shows you how to test it.

What an incident response plan is and why it matters

An incident response plan is a written set of decisions you make ahead of time: who does what, who gets called and which steps to follow when a security incident happens.

The standard reference in the US is NIST Special Publication 800-61. Its current version, Revision 3, was finalized on April 3, 2025, and replaced the older Computer Security Incident Handling Guide. Revision 3 ties incident response to the 6 functions of the NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond and Recover. The practical message for a small business is that response is not a separate project. It depends on preparation done long before anything goes wrong.

A good plan helps you:

• Contain damage faster, because people know what to unplug and what to leave alone.
• Protect evidence your insurer, investigators or attorney will need.
• Meet notification duties under state breach laws and contracts.
• Communicate calmly with staff, customers and partners.
• Recover in the right order, starting with the systems that keep revenue flowing.

The fill-in incident response plan outline

Copy this structure into a document and fill in the blanks. The sections below explain each part.

Assign roles and build your contact list

Roles and backups

Every role needs a named person and a backup, because incidents rarely happen when everyone is at their desk.

• Incident lead: makes decisions, keeps a timeline and coordinates everyone else. Often the owner, operations manager or IT manager.
• Technical lead: isolates systems, collects logs and works with your IT provider or forensic firm. This may be your managed IT service provider.
• Communications lead: handles messages to staff, customers and media, using approved templates.
• Legal and compliance contact: usually outside counsel, especially for breaches involving personal data.
• Executive approver: authorizes spending, shutting down operations and paying for outside help.

In a 10-person business, 1 person may hold 2 roles. That is fine, as long as it is written down and the backup knows.

Key takeaway: Write down who can make the 3 hardest calls: shutting down systems, contacting law enforcement and notifying customers. Those decisions cause the longest delays when nobody owns them.

Contact list

Assume email and your main phone system may be down. Keep this list printed and in a secure location outside your normal network.

Internal: incident lead, technical lead, owners or executives, HR and office manager, with mobile numbers.

External:

• IT support or managed service provider, including after-hours number
• Cyber insurance carrier claims line and policy number. Many policies require you to call them first and use approved vendors.
• Outside attorney, ideally one with privacy and data breach experience
• Bank fraud department and payment processor
• Key software vendors and your cloud or hosting provider
• Law enforcement: your local FBI field office, the FBI’s Internet Crime Complaint Center at ic3.gov, and CISA, which accepts incident reports 24/7 through cisa.gov/report or by phone at 888-282-0870
• Your domain registrar and website host

Define incidents and the response phases

Severity levels

Staff need to know what to report, and leaders need to know how loudly to react. Keep definitions simple.

An incident is anything that threatens the confidentiality, integrity or availability of your systems or data: a phishing click, a lost laptop, an unknown login, ransomware, a misdirected email with customer data.

Response phases

Your plan should describe what happens in each phase, in plain language.

1. Detect and report. How staff report a suspected incident, such as a phone number or a dedicated address that does not depend on email, and how the incident lead is alerted.
2. Assess. Confirm what happened, which systems and data are involved, and assign a severity level.
3. Contain. Disconnect affected devices from the network but leave them powered on unless your IT provider says otherwise. The FTC’s data breach guidance makes the same point: take affected equipment offline, but do not turn machines off until forensic experts arrive. Disable compromised accounts and block malicious senders or addresses.
4. Eradicate. Remove malware, close the hole the attacker used and reset credentials.
5. Recover. Restore from clean backups in priority order, monitor closely and return to normal operations. Your recovery targets, explained in our guide to RTO vs RPO, decide that order.
6. Review. Within 2 weeks, hold a short lessons-learned meeting and update the plan.

Create playbooks for your most likely incidents

Playbooks are 1-page checklists for specific scenarios. Start with the 4 most common for small businesses.

Ransomware - Disconnect affected devices from the network; do not power them off. - Call the incident lead, IT provider and insurer. - Identify which backups are clean and offline. - Do not contact the attackers or pay without legal, insurer and law enforcement input. - See our ransomware protection guide for prevention steps.

Business email compromise - Reset the account password, sign out all sessions and reset MFA. - Check for new forwarding rules and mailbox rules that hide messages. - Call your bank immediately if a payment was redirected, and report it to IC3. - Warn customers or vendors who may have received fake invoices.

Lost or stolen device - Remote lock or wipe through device management. - Revoke the device’s sessions and change passwords stored or used on it. - Confirm whether the disk was encrypted, which affects whether notification is needed.

Compromised account or password leak - Reset credentials and require multi-factor authentication. - Review sign-in logs for unusual locations or devices. - Check whether the same password was reused elsewhere.

Notification requirements

Every state, plus DC, Puerto Rico and the US Virgin Islands, has a data breach notification law, according to the FTC’s Data Breach Response guide. Requirements differ on what counts as personal information, deadlines and whether you must notify the state attorney general. Health, financial and other regulated data may trigger federal rules too, such as the HIPAA Breach Notification Rule. Your contracts and cyber insurance policy may also set their own reporting deadlines.

List in your plan which laws and contracts likely apply to you, and who confirms them during an incident. This is not legal advice; work with an attorney to confirm your obligations. Our US state data privacy laws guide is a useful starting point.

Test and maintain the plan

A plan nobody has practiced is a draft. Run a tabletop exercise at least once a year: gather the response team for 60 to 90 minutes, walk through a realistic scenario and talk through each decision. CISA offers free Tabletop Exercise Packages with ready-made cybersecurity scenarios, including ransomware and phishing.

Update the plan whenever you change IT providers, insurers, key staff or major systems, and record the last review date on the cover page.

Where to start this week

1. Copy the outline table into a document.
2. Fill in roles and backups.
3. Build and print the contact list.
4. Write the ransomware and email compromise playbooks first.
5. Store copies offline and in a secure location outside your main systems.
6. Book a 1-hour tabletop exercise within the next 90 days.

If an incident is already happening, skip to our checklist on what to do if your business is hacked.

Conclusion

An incident response plan is a set of decisions made calmly in advance so they do not have to be made in a panic. Name the people, write down the numbers, define what counts as an incident and keep short playbooks for the attacks you are most likely to face. Then practice once a year. Even a simple plan will save time, money and stress when it matters.

Sources

• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — April 2025 revision aligned with CSF 2.0
• FTC: Data Breach Response, A Guide for Business — containment, evidence preservation and state notification laws
• CISA: Tabletop Exercise Packages — free exercise scenarios for testing a plan
• FBI Internet Crime Complaint Center (IC3) — reporting cyber-enabled crime including ransomware and business email compromise
• CISA: Report a cyber incident — 24/7 incident reporting