Incident Response Plan Policy Template

1. Purpose

This policy establishes the roles, procedures, and communication protocols [Organization Name] follows to detect, contain, and recover from cybersecurity incidents.

2. Roles and Responsibilities

• Incident Response Lead: [name/role], has final authority over containment decisions
• Technical Response Team: [names/roles]
• Communications Lead: [name/role], manages internal and external notifications

3. Incident Classification

Incidents are classified as Critical, High, Medium, or Low severity based on [criteria: data sensitivity, systems affected, business impact].

4. Detection and Reporting

Employees who suspect a security incident must report it immediately to [reporting contact/channel]. Automated alerts are monitored by [monitoring team/provider].

5. Containment Procedures

Upon confirmation of an incident, the Technical Response Team will take containment action, which may include isolating affected systems, disabling compromised accounts, and blocking malicious traffic, within authority pre-approved by [approving authority].

6. Communication Protocols

• Internal: [who is notified, and when]
• Customers: [notification criteria and timeline]
• Regulators: [applicable disclosure requirements and timelines]

7. Recovery and Restoration

Systems will be restored from verified clean backups, with integrity confirmed before returning to production, following the process documented in [recovery runbook reference].

8. Post-Incident Review

Within [timeframe, e.g., 10 business days] of resolution, the response team will document what happened, what worked, and what changes the plan requires.

9. Testing

This plan will be tested via tabletop exercise at minimum [annually].