An incident response plan is a one-page answer to the question everyone asks at the worst possible moment: who does what, next? This template gives you the sections, the tables to fill in, and the decisions to make in advance. Print it, complete it with your team, and store a copy somewhere you can reach when email is down.
This template is a starting point, not legal advice. Adapt it with your counsel and your insurer.
How to Use This Template
- Fill in every table with names, numbers, and systems. Blanks are the failure.
- Keep it to a few pages. A plan nobody reads is not a plan.
- Store copies offline: printed, in a password manager, and on a phone. Assume your email and file shares are unavailable.
- Test the contact tree twice a year and record how long it takes to reach everyone.
- Review after every incident or near miss, and after any major system change.
1. Roles and Contacts
| Role | Name | Phone | Alternate |
|---|---|---|---|
| Incident lead (decides) | |||
| Technical lead (contains and restores) | |||
| Communications (staff, clients, press) | |||
| Executive sponsor | |||
| Outside counsel | |||
| Cyber insurer claims line and policy number | |||
| Incident response firm | 703-486-0200 (Envescent) | ||
| Law enforcement contact (decided with counsel) |
2. Systems and Data
List what you cannot operate without, and who owns each one. If a system is not on this list, nobody will think of it at 2 a.m.
| System | Data it holds | Owner | Vendor and support number | Recovery priority |
|---|---|---|---|---|
| Email and directory | 1 | |||
| Practice, case, or ERP system | 1 | |||
| File shares and document management | 2 | |||
| Accounting and payroll | 2 | |||
| Website and client portals | 3 |
3. First 24 Hours
- Confirm and declare. The incident lead decides whether this is an incident. Record the time and the decision.
- Stop the spread without destroying evidence. Disable compromised accounts, block the sender or address at the edge, and isolate affected machines from the network. Do not wipe, rebuild, or reinstall before the evidence is collected.
- Preserve. Collect logs, email, and disk images; note who collected what and when. Keep an evidence log.
- Open a separate channel. If email is compromised, move coordination to phones, a chat platform, or a conference bridge.
- Call counsel and the insurer. Counsel directs the investigation so it can be protected by privilege. The insurer decides who pays for forensics and whether their panel firm is required.
- Brief staff. One message, one channel, no speculation, and a named person to report anything unusual.
Detailed hour-by-hour guidance is in The First 72 Hours After a Cyber Incident.
4. Containment and Evidence
Preserve before you rebuild. Volatile evidence disappears the moment a machine reboots: memory, running processes, network connections, and logged-in sessions.
| Item | Source | Collected by | Hash | Storage location |
|---|---|---|---|---|
Chain of custody matters if the incident ends in litigation, an employment action, or an insurance dispute. Record who handled each item, when, and where it is stored.
5. Communications and Legal
- One spokesperson. Everyone else refers questions to them.
- Say what you know, and say when you will update. Do not speculate about cause, scope, or blame.
- Notification duties vary by state, contract, data type, and regulator. Confirm the obligations with counsel before you send anything.
- Document decisions with timestamps. Every assumption you make under pressure is a question later.
- Do not pay or negotiate with an attacker without counsel and the insurer involved.
- Law enforcement reporting is a decision to make with counsel, based on the crime, the data, and your obligations.
6. Recovery
- Rebuild from known-good images and verified backups, not from the compromised host.
- Restore in priority order from the table in section 2, and confirm integrity before returning to service.
- Rotate every credential the attacker could have touched: passwords, API keys, tokens, certificates.
- Close the entry point before systems come back online, or you will be re-infected.
- Watch closely for two weeks after recovery for the same indicators returning.
7. Post-Incident Review
Within two weeks, while the details are still fresh, answer five questions in writing: how did they get in, how long were they inside before anyone noticed, what did they take, what worked in this plan, and what will change. Assign owners and dates to each change. A review with no assigned actions is a meeting, not a review.
8. Test Annually
Twice a year, run the contact tree and time how long it takes to reach every person on the list. Once a year, walk through a tabletop scenario with the incident lead, counsel, and the insurer’s claims contact. Record the date, the participants, and the gaps found. Insurers ask for this, and it is the difference between a plan and a hope.
If you would rather have the plan reviewed, or want someone on call when it is used, see incident response and digital forensics. The evidence this template asks you to collect is the same evidence an independent assessment reviews before an incident, which is cheaper than discovering the gaps during one.
For an active incident, call 703-486-0200 now: after-hours and emergency response is billed at $275 per hour, published in the service menu.
Call 703-486-0200 Schedule a planning consultation