Free download · Incident response
Incident Response Plan Template (Free PDF)
Fill in the roles and phone numbers now; run the checklists during the incident. An IR plan's whole job is removing decisions from the worst morning of the quarter.
When something is very wrong at 7am, nobody thinks clearly — which is fine, because thinking was supposed to happen earlier. This template is the "earlier": one page of roles, contacts, and severity levels to fill in today, and one page of checklists for the three situations that actually happen to small businesses — the generic first hour, ransomware, and the phished mailbox that turns into payment fraud.
One rule sits above everything in it: call your cyber insurer before the cleanup starts. Most policies require their approved forensics and counsel, and wiping machines first can void coverage while destroying the evidence that proves what happened — and what didn't.
We ask for your first name and email, then the PDF downloads right here.
What's inside
Roles — incident commander, communications lead, technical lead, scribe, with named backups
Who we call, in order — IT/forensics, insurer hotline with policy number, attorney, bank fraud department, key vendors
Severity levels — what rates a 2am phone call vs a normal ticket, with blanks for your own examples
The six phases — prepare → identify → contain → eradicate → recover → learn
The first-hour checklist — isolate without powering off, start the log, convene roles, call the insurer, move comms off the suspect system
Ransomware playbook — backups before decisions, strain identification, why ransom conversations belong to counsel (OFAC), reporting
Phished-mailbox / payment-fraud playbook — kill sessions not just passwords, sweep inbox rules and OAuth grants, the bank call that outranks forensics
The template, explained
1. Roles
Four hats: the incident commander decides, the communications lead talks to staff and clients, the technical lead works the problem, the scribe keeps the log. One person can wear two hats, but every hat has a name and a backup — an incident with no commander becomes a group chat.
2. Who we call
Numbers, not names: IT/incident response, the cyber insurer's breach hotline with your policy number, your attorney, the bank's fraud department, and the vendors that matter (EHR, line-of-business software, phones). This list is why the plan gets printed — it's needed precisely when the systems holding it are suspect.
3. Severity levels
Sev 1: business-stopping or suspected data breach — all roles plus the insurer, immediately. Sev 2: real but contained (one system, one mailbox) — commander plus technical lead. Sev 3: nuisance — a normal ticket. Write your own examples into the blanks; severity debates during an incident are how an hour disappears.
4–7. The checklists
The first hour (isolate — don't power off, memory and logs are evidence; start the log; convene; call the insurer; move communications off the suspect system). Ransomware (check the immutable backup before any other decision; photograph the note; counsel and insurer own any ransom conversation — payments can carry OFAC sanctions exposure; report to FBI IC3). Phished mailbox (revoke sessions and tokens — a password reset alone leaves the attacker logged in; sweep inbox rules and OAuth grants; call the bank about payment changes immediately — wire recall windows are hours; warn contacts from a clean channel).
The phished-mailbox playbook pairs with our Office 365 Security Checklist — the hardening that stops the mailbox takeover in the first place.
After the fire
Lessons-learned within two weeks, the root cause actually closed, notification duties settled with counsel — and the next tabletop exercise on the calendar. A plan that's never rehearsed is a document; twice a year, run a scenario around a conference table and it becomes a reflex.
Incident response FAQ
What should an incident response plan include?
Roles with named people and backups, a contact list with the insurer's hotline and policy number, severity definitions, and step-by-step checklists for your likely incidents — at small-business scale that means ransomware and compromised email above all. If it doesn't fit on paper you can grab during the incident, it's documentation, not a plan.
What are the phases of incident response?
The standard six: prepare (this document), identify (what happened, how bad), contain (stop the spread), eradicate (remove the cause), recover (restore and verify), and learn (the post-incident review). Small businesses mostly fail at phase one — the other five go far better when phase one produced names, numbers, and rehearsal.
Should we pay a ransomware ransom?
That decision belongs to your attorney and insurer, not to the IT room — payments to sanctioned entities carry OFAC exposure, insurers have approved negotiators, and the answer depends heavily on whether your immutable backup survived. Which is why "check the backups before anything else" is the first line of the ransomware checklist: intact backups turn the ransom question into a non-event.
What is a tabletop exercise?
A rehearsal: your leadership team walks through a written scenario — "it's Friday 4pm and every file server shows a ransom note" — making the decisions the plan calls for, with no actual systems touched. An hour twice a year finds the broken assumptions (the contact who left, the backup nobody can log into) at conference-table prices instead of incident prices.
Want someone on the other end of that first call?
Datastrive builds incident response for Chicago-area businesses — the plan, the monitoring that catches it early, and the team that picks up at 7am. Free IR readiness review, including a tabletop scenario run with your leadership team.
Prefer to talk? Call 1-773-863-3868.
More free resources: IT Disaster Recovery Plan Template · Office 365 Security Checklist · see all free resources
Template for general preparedness from Datastrive — legal notification duties and insurer requirements vary by policy, industry, and state. Engage counsel for determinations. Not legal advice.