Incident Response Plan

Incident Response Plan template: The organization's plan for detecting, handling, reporting and recovering from cybersecurity incidents, with the ten elements NIST SP 800-53 IR-8 requires.

Type	Program stage	Status	Template version	NIST basis
Plan	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The organization’s plan for detecting, handling, reporting and recovering from cybersecurity incidents, with the ten elements NIST SP 800-53 IR-8 requires.

Controls satisfied

Control	Title
IR-8	Incident Response Plan
IR-8(1)	Breaches
IR-4	Incident Handling
IR-5	Incident Monitoring
IR-6	Incident Reporting
IR-7	Incident Response Assistance
IR-2	Incident Response Training
IR-3	Incident Response Testing

Downloads

Variant	Ready to adopt	Annotated
All baselines	Word · Markdown	Word · Markdown

Preview (annotated)

Guidance

This plan answers the ten questions IR-8a asks of an incident response plan; each section names the IR-8 item it meets. The handling sections follow the NIST Cybersecurity Framework (CSF) 2.0 Functions, as NIST SP 800-61 Rev. 3 (April 2025) does: Detect, Respond and Recover for handling an incident, with preparation and improvement around them. Keep the plan short enough to use during an incident, and move step-by-step instructions into the incident handling playbook. The breach part of section 5 meets IR-8(1), which is in the Privacy baseline; a system that processes personally identifiable information needs it, and any organization that holds such information benefits from it.

Plan owner	Approved by	Review cycle	Version and date
Chief Information Security Officer	Fill in: personnel or roles that review and approve the incident response plan Typical: the Chief Information Security Officer	Fill in: the frequency at which to review and approve the incident response plan Typical: annually	Fill in: version number and approval date

1. Purpose and scope

This plan is Organization name’s roadmap for its incident response capability: how incidents are detected, handled, reported and learned from (IR-8a.1). It applies to every system Organization name owns or operates, or that is operated on its behalf, and to everyone with access to those systems.

2. How incident response fits the organization

Incident response is part of Organization name’s security program and risk management. The Incident response team works with system owners, who remain responsible for their systems during an incident, and with the contingency planning, business continuity and crisis communications functions when an incident affects operations (IR-8a.3).

The capability is sized for Organization name’s mission, size, structure and functions as follows: Fill in: how the capability is staffed and sourced, for example an internal team with a retained incident response provider for major incidents (IR-8a.4).

3. Roles and responsibilities

Responsibility for incident response is designated to Fill in: entities, personnel, or roles with designated responsibility for incident response Typical: the incident response team, led by its designated lead (IR-8a.10). The capability is organized as follows (IR-8a.2).

Role	Responsibility
Chief Information Security Officer	Owns this plan; declares major incidents; decides with legal counsel on outside notification; reports to senior leadership
Incident response lead	Leads the Incident response team; coordinates handling of each incident from declaration to closure
Incident response team	Analyzes, contains, eradicates and recovers from incidents; keeps the incident record
Security operations team	Monitors for and triages events; escalates suspected incidents
System owner	Provides system knowledge and access; approves containment and recovery actions on their system
Legal counsel	Advises on evidence, notification duties and law enforcement contact
Communications	Prepares internal and external messages approved by the Chief Information Security Officer
Human resources office	Supports incidents that involve personnel
All personnel	Report suspected incidents promptly and follow the team’s instructions

4. Reportable incidents

A reportable incident is any event that actually or imminently jeopardizes the confidentiality, integrity or availability of Organization name’s information or systems, or that violates security policy or acceptable use (IR-8a.5). Examples include malware infections, unauthorized access, lost or stolen devices with Organization name information, and data sent to the wrong recipient. When in doubt, report it.

The Incident response team assigns each incident a severity, which sets the response time and who is informed.

Severity	Description	Response
Critical	Fill in: description, for example widespread impact, confirmed data breach or ransomware	Fill in: response time and escalation, for example immediate; the Chief Information Security Officer and senior leadership informed
High	Fill in: description	Fill in: response time and escalation
Moderate	Fill in: description	Fill in: response time and escalation
Low	Fill in: description	Fill in: response time and escalation

5. Reporting and notification

Personnel report suspected incidents to the Incident response team within Fill in: time period for personnel to report suspected incidents to the organizational incident response capability Typical: 1 hour of discovery, through Fill in: reporting channels, for example the service desk phone number and the incident report form, and reports are recorded on the incident report form. The Incident response team reports incident information to Fill in: authorities to whom incident information is to be reported Typical: senior leadership, legal counsel, and any regulator, customer or partner that law or contract requires be notified.

Federal systems

Federal agencies notify the Cybersecurity and Infrastructure Security Agency (CISA) of incidents under FISMA (44 U.S.C. §§ 3553 and 3554). As of October 2026, the CISA Federal Incident Notification Guidelines (effective April 1, 2017) require notification within one hour of the incident being identified by the agency’s top-level incident response team, security operations center or IT department. Record the agency’s reporting channel to CISA and who submits the report: Fill in: agency CISA reporting procedure and submitter.

OMB Memorandum M-25-04 (January 15, 2025), the most recent FISMA guidance memorandum as of October 2026, section X, defines a major incident and requires a major incident determination for any breach affecting the personally identifiable information of 100,000 or more people. Events unresolved after 72 hours of investigation are reported to CISA. A major incident is reported to CISA and the OMB Office of the Federal Chief Information Officer within 1 hour of the determination, and to the appropriate congressional committees and the Office of Inspector General within 7 days of the reasonable-basis determination. Use M-25-04’s definition when major incidents are declared (section 3), and record who makes the determination and who sends each report: Fill in: officials who determine major incidents and report to OMB, CISA, Congress and the Office of Inspector General.

Breaches involving personally identifiable information

A breach is an incident involving personally identifiable information: its loss of control, compromise, unauthorized disclosure or acquisition, or a similar occurrence where someone other than an authorized user accesses or potentially accesses it, or an authorized user does so for other than authorized purposes. Suspected breaches are reported like any other incident, in any medium or form, including paper, oral and electronic. The Incident response team tells the Senior privacy official as soon as personally identifiable information is, or may be, involved, and the Senior privacy official leads the steps below, which section 5.8 of the incident handling playbook carries out (IR-8(1)).

Element	How Organization name meets it
Deciding whether to notify individuals and other organizations, including oversight organizations (IR-8(1)(a))	The Senior privacy official decides with legal counsel and the Chief Information Security Officer, using the harm assessment and the requirements below: Fill in: who else is consulted, and how quickly the decision is made
Assessing harm, embarrassment, inconvenience or unfairness to individuals, and how to mitigate it (IR-8(1)(b))	The Senior privacy official weighs the sensitivity of the information, the number of individuals, whether it was actually accessed or used, and the context. Mitigation available: Fill in: for example credit monitoring, a call center, help replacing account numbers
Applicable privacy requirements (IR-8(1)(c))	Listed below, and reviewed each time this plan is reviewed

Requirement	Applies to	Notice required, to whom	Deadline
Fill in: law, regulation, policy or contract	Fill in: information, individuals or systems it covers	Fill in: who must be notified	Fill in: time allowed
Fill in: requirement	Fill in: scope	Fill in: notice	Fill in: deadline

Federal systems

OMB Memorandum M-17-12 (January 3, 2017), section VII, requires the senior agency official for privacy to develop a breach response plan as part of the agency’s formal incident response plan; this section can serve as that plan once it covers each element section VII lists. Record the breach response team the head of the agency designates, which the senior agency official for privacy leads and which includes at least the CIO or designee, the senior agency information security officer, legal counsel, and legislative affairs and communications officials (section VII.A): Fill in: team members by title, and the criteria for convening the team. The head of the agency makes the final decision on notifying individuals, on the senior agency official for privacy’s advice (section VII.G). The principal security operations center reports the status of each breach reported during the fiscal year to the senior agency official for privacy at the end of each quarter, and that official validates the report (section IX). The senior agency official for privacy reviews the plan at the end of each fiscal year (section X.B) and convenes the team for a tabletop exercise at least annually (section X.A). For a breach that is a major incident under OMB M-25-04, section X, a supplemental report goes to Congress within 30 days of discovering the breach. As of October 2026.

6. Handling incidents

Handling follows the CSF 2.0 Functions. The incident handling playbook holds the step-by-step instructions, with first steps for each common type of incident.

Detect

The Security operations team monitors alerts, logs and user reports; triages events; and escalates suspected incidents to the Incident response team, as the log review procedure describes for findings in audit records. The team confirms whether an incident has occurred, declares it, assigns a severity and opens an incident record (IR-5).

Respond

The Incident response team analyzes the incident to understand its scope and cause, contains it to limit damage, and eradicates its cause, coordinating each action with the affected System owner. It preserves evidence, keeps the incident record current, and coordinates communication and notification as section 5 describes.

Recover

The System owner restores affected systems and data, with the Incident response team confirming they are clean and monitored for recurrence. Recovery that invokes a contingency plan follows that plan.

Improve

After each incident of Fill in: severity that requires a lessons-learned review, for example High or Critical, the Incident response team holds a lessons-learned review within Fill in: time after closure, for example 10 business days. Changes to procedures, training and testing that result are tracked to completion (IR-4c).

7. Sharing incident information

Organization name shares incident information with Fill in: parties, for example sector information sharing organizations, suppliers involved in the incident, and law enforcement when Fill in: conditions and who approves (IR-8a.8). Suppliers of affected products or services receive the information they need to respond (IR-6(3)).

8. Metrics

The Incident response team measures the capability with these metrics, reported to the Chief Information Security Officer Fill in: frequency, for example quarterly (IR-8a.6):

• Fill in: metric, for example mean time from detection to containment by severity
• Fill in: metric, for example number of incidents by type and severity
• Fill in: metric, for example percentage of lessons-learned actions completed on time

9. Resources and management support

Maintaining and maturing the capability requires Fill in: staff, tools, retained services and budget, which the Senior leader supports through Fill in: how resources are approved, for example the annual security budget (IR-8a.7).

10. Training and testing

Incident response roles receive training on joining the role and at the interval the Incident Response Policy sets (IR-2). The capability is tested through exercises at the interval that policy sets, and the results feed section 6’s improvement step (IR-3). The tabletop exercise kit holds the materials and the after-action report for each exercise. Where Organization name holds personally identifiable information, at least one exercise each year simulates a breach (IR-2(3)).

11. Plan maintenance

• Fill in: personnel or roles that review and approve the incident response plan Typical: the Chief Information Security Officer reviews and approves this plan Fill in: the frequency at which to review and approve the incident response plan Typical: annually (IR-8a.9).
• The Chief Information Security Officer distributes copies to Fill in: incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed Typical: the incident response team members, by role and Fill in: organizational elements to which copies of the incident response plan are to be distributed Typical: the security operations, legal, communications and human resources functions (IR-8b).
• The Chief Information Security Officer updates the plan for system and organizational changes and for problems found in incidents or exercises (IR-8c), and communicates changes to Fill in: incident response personnel (identified by name and/or by role) and organizational elements Typical: everyone who received the plan (IR-8d).
• The plan is stored in Fill in: location with restricted access to protect it from unauthorized disclosure and modification (IR-8e).

Appendix A. Contacts

Role	Name	Phone	Email	Backup
Incident response lead	Fill in: name	Fill in: phone	Fill in: email	Fill in: backup name
Chief Information Security Officer	Fill in: name	Fill in: phone	Fill in: email	Fill in: backup name
Legal counsel	Fill in: name	Fill in: phone	Fill in: email	Fill in: backup name
Communications	Fill in: name	Fill in: phone	Fill in: email	Fill in: backup name
Retained incident response provider	Fill in: company	Fill in: phone	Fill in: email	Fill in: contract reference