Home / Insights / Preparing an Incident Response Plan

Preparing an Incident Response Plan

A usable incident plan helps people make decisions when information is incomplete and time matters. It should identify authority, contacts and recovery priorities in language the team can use.

Published 22 October 2026 · Content updated 29 October 2026
Published by CyberXpert

Start with important services

Identify the services whose loss or compromise would affect the organisation most. Record the systems, people and suppliers they depend on. This context helps the incident lead decide what needs attention first, rather than treating every device or alert as equally urgent.

A practical plan outline: important services and dependencies; incident lead and deputies; reporting and triage route; decision authority; alternative communications and supplier contacts; evidence and decision log; recovery priorities; and maintenance of the plan. Keep sensitive contact and system details appropriately protected.

Name the decision-makers

Assign an incident lead and deputies. Establish who can isolate systems, approve restoration, engage external support and authorise communications. Include business leadership, IT, operations and relevant legal or privacy advisers. Avoid a plan that depends on a single unavailable person.

Prepare safe communication

An email compromise may affect the communication route you normally use. Agree an alternative method and keep essential contacts accessible if core systems are unavailable. Protect the plan and contact list appropriately; it may contain information that should not be broadly shared.

Define escalation and initial actions

Explain how staff report a concern and how it is triaged. Give responders a way to record the timeline, decisions and evidence references. Detailed containment actions need technical context and authorisation; a generic plan should not encourage uncoordinated changes to affected systems.

Read what an incident investigation can establish to understand evidence sources, timelines and material limitations.

Connect suppliers and contracts

Record support contacts, activation procedures and contractual arrangements. Check cyber-insurance notification and approved-provider requirements where applicable. CyberXpert incident support is available 24/7; response targets and retainer commitments are agreed separately.

Use our guide to what to check in an incident response retainer when agreeing activation, authority and commercial arrangements.

Keep legal and regulatory decisions with the right owners

The plan should identify who will assess notification duties and seek advice. Technical investigation supports those decisions, but does not replace legal analysis. Do not assume that every incident has the same reporting obligations or that a technical supplier makes the legal decision.

Plan recovery as a controlled process

Define business recovery priorities, dependencies and the evidence needed before restoration. Test backups and restoration procedures separately. A written plan or tabletop discussion does not demonstrate that a backup is usable or that a system can be restored within a particular period.

Our guide to planning controlled service recovery connects restoration prerequisites with business approval and acceptance checks.

Exercise and maintain the plan

Use a tabletop discussion to test the decision route and identify missing information. Agree objectives, participants and exercise boundaries in advance. Include the incident lead, business and technical owners, a facilitator and a note-taker; invite communications, legal/privacy advisers and relevant suppliers for the decisions they own. See the NCSC Exercise in a Box preparation guidance.

Structure the discussion around these decisions:

Confirm who leads the exercise, what it covers and how decisions will be recorded.
Agree how reports are assessed and what information the incident lead needs.
Review escalation, containment authority and business-impact decisions.
Check supplier coordination, recovery prerequisites and communications ownership.
Debrief, assign actions to named owners and agree how improvements will be checked.

For a practical rehearsal, read our guide to running a cyber incident tabletop exercise.