Incident Response Plan Template: The Sections Every IR Plan Needs (NIST 800-61 Aligned)
An IR plan answers one question before trouble asks it. Who does what, in what order, with what power. This template covers every part a solid plan needs. It follows the NIST 800-61 steps that most insurers and auditors check against.
Key takeaways
- A plan is a set of decisions, not an essay. Each part pre-approves a call that cannot wait for a meeting. Who may cut off a network segment? Who may call the lawyer? Who may call the retainer firm?
- NIST SP 800-61 is the map insurers and auditors use. Its steps are prepare, detect and analyze, contain and recover, and review after. The 2025 update adds cloud, outside partners, and comms results.
- The most-skipped part decides your speed. That is the outside-resources page. It names your IR firm, breach lawyer, notice vendor, and your carrier's panel rules. By name.
- Playbooks per world beat one generic list. Cutting off a cloud workload and cutting off a factory PLC are different moves. The blast radius differs too.
What an IR plan is, and is not
An IR plan is the record of choices made before an incident. How bad is bad? Who leads? Who calls whom? What playbook runs in which system? It is not a policy about the value of security. It is not a page of vendor logos. If a part does not help someone act faster during an incident, cut it.
The shape most plans follow comes from NIST SP 800-61. Prepare. Detect and analyze. Contain, clean, and recover. Review after. Each part below maps to a step. That way a reviewer can trace the plan end to end.
The plan template, part by part
| Plan part | What it must hold | The common gap |
|---|---|---|
| Mission and scope | Which systems and teams the plan covers, and which it does not | Scope so wide that nobody knows if outside vendors are in or out |
| Roles and contact tree | Named people, not just titles. Incident commander, tech lead, comms lead, legal. Plus their backups | A contact list that died two reorgs ago |
| Severity levels | Clear tests for each level, plus the escalation path per level. What a Sev-1 starts that a Sev-3 does not | Adjectives instead of tests. "Critical" alone means nothing |
| Detection sources | The alerts, logs, and reports you truly run today, and who sorts each | A wish list of sources nobody watches |
| Containment playbooks | One per world: office IT, cloud, OT/ICS. Each with its own moves and powers | One generic "isolate it" that breaks a production line |
| Outside resources | Your named IR firm, breach lawyer, notice vendor, forensics help, plus your carrier's claim line and panel rules | This part turns a 2am panic into a 2am phone call |
| Comms plan | Inside notice order, outside talk rules, legal triggers, and who speaks | Legal review happening during the incident, not before |
| Notice matrix | Deadlines by law and data type. GDPR 72 hours. HIPAA 60 days. State breach laws. Plus the proof each needs | Teams meeting deadlines mid-incident for the first time |
| Evidence handling | What to keep, where, and for how long, decided while systems still run | Logs that expired before the probe began |
| Review after | Lessons learned are required. Fixes get owners and dates | Reviews that happen only for huge incidents |
The steps, and what your plan pre-decides for each
Prepare. This is where a plan earns its value. The contact tree. The pre-approved calls. The retainers. The drill schedule. Most of a plan's quality shows here before any incident.
Detect and analyze. Who says an alert is an incident? Who scopes the impact? How is evidence kept while the clock runs? If severity tests are fuzzy, everything after them inherits the fuzz.
Contain, clean, recover. The per-world playbooks. A cloud playbook that snapshots and isolates a workload fails the moment the workload is a PLC running a real machine.
Review after. The review is required. Fixes get owners and dates. The findings feed back into detection and hardening.
The outside-resources part, where speed is won
Every plan should name names. The IR firm, with the terms of its retainer. The breach lawyer. The notice vendor. If you carry cyber insurance, add the carrier's claim line and panel rules. Many policies pay panel firms in full. They pay outside firms only in part. Some need approval before you go off-panel. Learning that during an incident costs hours. Writing it down first costs one short paragraph.
How to test the plan without an incident
Run a tabletop. Pick one likely scene. Open the plan. Ask "who does what in the first hour?" Walk every part. The gaps go into the next revision. A plan that survives tabletops is a plan. A plan never tested is just paper.
Frequently asked questions
How long should an IR plan be? Long enough to pre-decide everything, and no longer. For most groups that is 10 to 20 working pages. The table above is the frame.
How often should we update the plan? At least once a year. Also after every real incident, every tabletop that finds a gap, and every big change. New cloud. New OT. An acquisition.
Policy, plan, playbook. What is the difference? The policy states intent and power. The plan assigns roles, tests, and contacts. The playbook is the step list for one scene or one world. You need all three. Mixing them is why plans bloat.
Do cloud and OT need different plans? One plan, with a playbook per world inside it. Severity tests and the contact tree stay shared. Containment moves split fully.
**Where do IR firms fit in the plan?** In the outside-resources part. Named, with engagement terms, and ideally on retainer. The plan's first call should start work, not a buying chat.
Browse documented DFIR and incident response firms, filtered by carrier panel status and disclosed SLA →This template reflects the NIST SP 800-61 lifecycle (Revision 2's four phases; Revision 3's April 2025 update) and the regulatory deadlines covered in our separate GDPR and HIPAA guides. Last verified: October 2026. Have a correction or addition? Request inclusion or a correction →
Continue reading
Best Incident Response Companies 2026: Ranked by What's Documented, Not What's Claimed
Search for the best incident response companies and you get two things. Vendor blogs that rank themselves first. And listicles that rank by adjectives. Neither survives contact with a real incident. What survives is evidence: which firms carriers' claims teams keep re-hiring, what the firms document about their own capability, and how their claims check out. This page ranks the market's most-documented IR firms. It tells you exactly what the ranking can and cannot say.
Best Operational Technology (OT) Incident Response Firms 2026: Ranked by What's Documented, Not Claimed
Search for OT security companies and you get two bad options. Vendor listicles rank whoever pays them. Vendor blogs rank themselves. The OT market deserves better, because a wrong pick costs production hours. This page lists the OT incident response firms we could verify from their own published services. It puts them in the order the evidence supports. Where the evidence is thin, it says so.