An incident response plan is a documented, tested process for detecting, containing and recovering from cybersecurity incidents such as ransomware, business email compromise or data breaches. A widely used structure has six phases: Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned. A good plan names who does what, how severity is decided, who must be notified, and which playbooks to follow, so decisions are made quickly under pressure.
Key Takeaways
- The plan must define roles, severity levels, communication paths and decision authority.
- Playbooks for common scenarios (ransomware, BEC, lost device, data leak) speed up response.
- Legal, insurance and regulatory notification requirements must be built in.
- Test the plan with tabletop exercises at least annually.
- Keep an offline copy, since systems may be unavailable during an incident.
The 6 Phases of Incident Response
| Phase | Objective | Key activities |
|---|---|---|
| 1. Preparation | Be ready before an incident | Plan, roles, tools, logging, backups, training, contact lists |
| 2. Identification | Confirm and classify the incident | Triage alerts, gather evidence, assign severity |
| 3. Containment | Stop the spread | Isolate devices, disable accounts, block indicators |
| 4. Eradication | Remove the threat | Remove malware, close vulnerabilities, reset credentials |
| 5. Recovery | Restore normal operations | Restore from clean backups, monitor for reinfection |
| 6. Lessons learned | Improve | Post-incident review, update controls and plan |
Incident Response Plan Template
1. Purpose and scope
Define which systems, data, locations and incident types the plan covers.
2. Roles and responsibilities
- Incident commander: leads response and makes decisions.
- Technical lead: directs investigation and containment.
- Communications lead: manages internal and external messaging.
- Legal and compliance: advises on notification obligations.
- Executive sponsor: approves major business decisions.
- External partners: MDR provider, forensic firm, cyber insurer, outside counsel.
3. Severity levels
- Low: contained event, no data impact.
- Medium: limited compromise of a user or device.
- High: multiple systems affected or sensitive data at risk.
- Critical: business-wide outage, ransomware, or confirmed breach of regulated data.
4. Communication plan
Use out-of-band channels if email or Teams may be compromised. Pre-approve templates for staff, customers and regulators.
5. Playbooks
Include step-by-step playbooks for ransomware, business email compromise, compromised admin account, lost device and data exfiltration.
6. Evidence handling
Define how logs and images are preserved for investigation, insurance and potential legal action.
7. Notification requirements
List regulatory, contractual and insurance notification timelines that apply in your jurisdictions, such as US state breach laws, HIPAA, or UAE data protection rules.
8. Testing and maintenance
Schedule tabletop exercises and update contacts and playbooks after each test or real incident.
Tools That Support Incident Response
- Microsoft Defender XDR for correlated incidents and automated investigation.
- Microsoft Sentinel for SIEM and automated playbooks.
- Immutable backups for clean recovery.
- Privileged access controls to limit attacker movement.
Building your broader security program? See our Zero Trust roadmap.
How Skytech Enterprise Helps
Our incident response readiness service writes and tests plans and playbooks, runs tabletop exercises and aligns response with your tools. For ransomware-specific planning, see ransomware recovery readiness. Contact our team.
Frequently Asked Questions
What are the 6 phases of incident response?
Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned.
How often should an incident response plan be tested?
At least annually through tabletop exercises, and after major changes to systems, staff or after a real incident.
Who should be on the incident response team?
An incident commander, technical lead, communications lead, legal and compliance, an executive sponsor and key external partners such as your MDR provider and cyber insurer.
Is an incident response plan required for compliance?
Most frameworks, including SOC 2, ISO 27001, HIPAA and NIST CSF, expect documented incident response procedures.
What is a tabletop exercise?
A discussion-based simulation where the team walks through a realistic scenario to test decisions, communication and the plan itself.
Should we contact our cyber insurer first?
Check your policy. Many insurers require early notification and may require you to use approved response firms.