What Is an Incident Response Plan?

An incident response plan is a written document that says who does what, in what order, when a security incident happens: how it is detected, who is called, how it is contained, who communicates with whom, how systems are recovered, and what is reviewed afterward. Its purpose is to replace panic with a checklist.

What the plan should contain

• Roles and contacts. Incident lead, IT provider's response line, cyber insurer's claims number, legal counsel, executive decision-maker, communications owner. Home phone numbers, because email may be down.
• Severity levels. What counts as a minor event vs a business-wide incident, and who can declare each.
• Detection and reporting. How employees report something suspicious and who triages it.
• Containment steps. Isolate devices, disable accounts, protect backups, preserve evidence. See what to do after a ransomware attack for the ransomware-specific version.
• Notification obligations. Insurer timelines, state breach laws, contracts, regulators. See what is a data breach.
• Recovery priorities. Which systems come back first, drawn from your business continuity plan.
• Communication templates. Internal update, customer notice, holding statement.
• Post-incident review. What happened, what worked, what changes.

Keep it usable

A ten-page plan people can follow beats a fifty-page plan nobody has read. Print it. Store a copy somewhere that does not depend on the systems that might be down.

Test it

A tabletop exercise once or twice a year, walking through a realistic scenario with the people named in the plan, finds the gaps before an attacker does. Insurers and frameworks increasingly ask whether you have done one.

Mentis Group helps clients build and exercise incident response plans through Enhanced Cybersecurity, and provides breach remediation through our IT Project Services when a plan has to be executed for real.

Have a question about your own environment? Schedule a consultation with Mentis Group or call (866) 901-7808.