Incident Response Plan (IRP)

An incident response plan provides structure during high-stress situations so teams do not improvise critical decisions.

Plan essentials

• Roles and escalation paths across security, IT, legal, and communications.
• Playbooks for common incident types such as ransomware or cloud compromise.
• Criteria for declaring an incident and moving between response phases.
• Communication templates for executives, regulators, and customers.

Keep it current

• Conduct tabletop exercises at least twice per year.
• Update contact lists and call trees regularly.
• Capture lessons learned and feed them into control improvements.