83% of SMBs have no documented IR plan. When an incident hits, you're starting from zero. This 12-page editable template walks your team through roles, severity classification, containment checklists, evidence preservation, communications templates, and regulator deadlines — before you need them.
The IR Plan Template covers the full incident lifecycle
Most organizations have no plan when an incident hits. They make costly decisions in real time — who do we call, do we isolate the network, when do we notify regulators? This template gives your team a documented process before you're in the fire.
First 15 minutes: IR Lead notification, severity assessment, evidence preservation, out-of-band channel activation. Includes initial containment checklist.
Network isolation, credential revocation, remote access tool disablement, firewall blocking, enhanced logging activation.
Malware and persistence removal, vulnerability patching, credential reset, firewall hardening, DFIR firm engagement.
Clean backup restoration, critical system sequencing, monitoring for re-infection, perimeter control updates based on lessons learned.
HIPAA 60-day, GDPR 72-hour, SEC 8-K 4 business days, NYDFS 72-hour, DORA 4h/24h. Template notifications included.
Response evaluation table, gap analysis, action items, IR plan maintenance log update. Complete within 2 weeks of closure.
Why IR plans matter
Every one of these incidents involved organizations that didn't have a documented, practiced IR plan. The difference between a $4M recovery and a $18M recovery is often having the right plan and the right people — before the incident.
February 2024. UnitedHealth subsidiary paid $22M in bitcoin within a week. The attack disrupted healthcare payments nationwide for months. The IR plan Template includes the exact notification timelines and vendor contact protocols thatChange Healthcare needed.
2019. Ransomware disabled 911 dispatch, email, and payment systems for weeks. The city refused to pay the $76,000 ransom — but spent $18M on recovery. The playbook covers the exact pay/don't pay decision tree and the regulatory notification timelines that applied.
2013. Point-of-sale malware exfiltrated 40M payment cards. The initial access vector was a third-party HVAC vendor. The IR plan Template includes a vendor contact sheet and supplier risk playbook that could have changed this outcome.
September 2023. Social engineering attack on LinkedIn employee data led to a 10-month recovery. No ransomware detonation — pure operational disruption and data exposure. The IR Plan Template covers social engineering and insider threat response scenarios.
Free download
Enter your work email and we'll send the 12-page PDF instantly — roles matrix, severity classification, containment checklists, evidence preservation, communications templates, 3 tabletop scenarios, and regulator notification deadline reference.
Live tabletop exercises delivered over Zoom, Meet, or Teams. Walk through the IR Plan Template scenarios — ransomware, BEC/wire fraud, insider data theft — with your IR team, executives, and legal counsel.