FREE TEMPLATE · WORD TEMPLATE
Incident response plan
A complete, editable incident response plan aligned to NIST SP 800-61r3 and NIS2. It covers roles, severity and escalation, the response phases with checklists, evidence handling, regulatory reporting hooks and post-incident review.
What's inside
- Role table with deputies and an external contacts list (DFIR, insurer, CSIRT, police)
- Four-level severity matrix with response times and escalation
- Phase checklists for preparation, triage, containment, eradication and recovery
- Evidence register and chain-of-custody table
- Regulatory reporting table for NIS2, DORA, CRA and GDPR
- Post-incident review form and maintenance log
Sections
1. Purpose, scope and authority2. Definitions and incident categories3. Roles and responsibilities4. Severity matrix and escalation5. Preparation6. Detection and triage7. Containment and evidence handling8. Eradication and recovery9. Regulatory reporting and notifications10. Communication11. Post-incident review and improvement12. Testing, maintenance and records
How to use it
- Fill in the fields and role tables, and adapt the severity criteria to your services
- Link the scenario playbooks you use in the incident category table
- Have the plan approved by the management body and store an offline copy
- Test it in a tabletop exercise and update it after every SEV-1 incident
Companion playbook
Incident response playbook aligned to NIST SP 800-61r3 and NIS2 →
Same house style as every Secrato template: a start sheet with instructions, light blue cells to fill in, and version control. Free to use within your organisation. This template is practical guidance, not legal advice.
Get the template
Enter your work e-mail and we will send you a personal download link straight away. We may follow up with related guidance; you can opt out at any time.
