Incident response plan
Also known as: IR plan, cyber incident response plan, security incident response plan
An incident response plan is a documented set of steps an organization follows when a cybersecurity incident happens, such as ransomware, a hacked email account, or a data breach.
It defines roles, contacts (including IT providers, cyber insurers, lawyers, and police), how to contain the damage, preserve evidence, communicate with staff and customers, restore systems, and learn from what happened. While writing a plan takes only a few days, having one ready can cut the cost and chaos of an attack dramatically.
Incident response plan, explained at three levels
At home
An incident response plan is like a home fire escape plan. Everyone knows the exits, where to meet, and who calls 911 before there's any smoke.
At work
A response plan helps a business act quickly and calmly during a cyberattack, limiting damage and cost.
At home
A personal version might list what to do if your email is hacked: change passwords, check forwarding rules, warn contacts, and call your bank.
At work
Plans typically follow phases: preparation, detection, containment, eradication, recovery, and lessons learned. Include contact lists printed offline, since systems may be down.
At home
Scammers sometimes pose as tech support after an attack. In my opinion, deciding in advance who you'll trust to help is part of the plan.
At work
Define decision authority, notify your cyber insurer before hiring responders where the policy requires it, preserve logs, plan legal and regulatory notification, practise with tabletop exercises, and update the plan after every incident.
Real-world examples
At home
Carlos's email was hacked. Because he'd written down steps in advance, he secured his account, checked for forwarding rules, and warned friends within an hour.
At work
Nadia's Toronto MSP wrote an incident response plan with a small accounting firm. When ransomware struck months later, everyone knew their role, and recovery took two days instead of two weeks.
How it compares
| feature | Incident response plan | Disaster Recovery |
|---|---|---|
| Focus | Handling cyber incidents | Restoring systems after any disaster |
| Key steps | Contain, investigate, communicate | Restore, fail over |
| Involves | IT, leadership, legal, insurer | Mainly IT |
| Overlap | Recovery phase | Ransomware recovery |
Incident response manages the attack. Disaster recovery restores the systems.
For analysts
I'd keep the incident response plan short enough to use under stress, with a one-page summary on top. A 60-page plan nobody can find won't help at 2 a.m.
History & origin
Formal computer incident response began after the Morris worm in 1988, which led to the creation of the CERT Coordination Center at Carnegie Mellon University. The US National Institute of Standards and Technology published its incident handling guide, SP 800-61, in 2004, with major revisions in 2012 and 2025, when it was aligned to the NIST Cybersecurity Framework 2.0. In Canada, mandatory reporting of privacy breaches posing a real risk of significant harm took effect under federal privacy law in November 2018, and the Canadian Centre for Cyber Security published incident response guidance for small and medium organizations. Cyber insurers increasingly asked whether businesses had incident response plans. In my view, the worst time to decide who's in charge is in the middle of an attack.