1. Client Profile & Emergency Contacts
Emergency Contact Matrix
| Role | Name | Phone | Escalation Notes |
|---|
2. Table of Contents
3. Purpose, Scope & Objectives
This Incident Response Plan establishes the procedures to prepare for, detect, analyze, contain, eradicate, recover from, and document cybersecurity incidents. The plan supports business continuity, disaster recovery, cyber insurance obligations, evidence preservation, and compliance reporting.
- Minimize operational disruption and data loss.
- Protect client, employee, and business information.
- Preserve evidence and maintain chain of custody.
- Coordinate internal, legal, insurance, and technical response activities.
4. Incident Severity & Escalation Matrix
| Severity | Definition | Examples | Escalation |
|---|---|---|---|
| Low | Minimal impact | Blocked phishing email, isolated suspicious file | IT review |
| Medium | Limited business impact | Single infected workstation, credential reset event | IT Lead / Management |
| High | Major risk or disruption | Email compromise, confirmed malware, data exposure concern | Executive, legal, insurance as needed |
| Critical | Enterprise-wide or severe event | Ransomware, active breach, widespread outage | Executive response team, insurance, legal, DRP activation |
5. IR Lifecycle SOP
Preparation
Maintain backups, MFA, asset inventory, admin access controls, endpoint protection, monitoring, and tested DR procedures.
Identification
Validate alerts, classify incident type, document source, preserve logs, and assign severity.
Containment
Isolate affected systems, disable accounts, revoke sessions, block indicators, and prevent lateral movement.
Eradication
Remove malware, close exploited vulnerabilities, reset credentials, rebuild systems where needed, and verify clean state.
Recovery
Restore services from clean backups, validate functionality, monitor closely, and confirm business approval.
Lessons Learned
Review root cause, response timeline, control gaps, insurance requirements, and required improvements.
6. Incident-Specific Playbooks
Business Email Compromise / Email Hack
Ransomware / Malware
Data Breach / Sensitive Data Exposure
Lost or Stolen Device
7. Communication & Notification Protocols
| Party | Trigger | Owner | Method | Notes |
|---|
8. Evidence Handling & Chain of Custody
| Evidence Item | Source | Collected By | Date/Time | Storage Location |
|---|
Embedded Screenshots / Evidence Images
9. Disaster Recovery Plan Integration
The IR team shall coordinate recovery activity with the client Disaster Recovery Plan to ensure restoration priorities, RTO/RPO requirements, backup validation, and executive authorization are followed.
| System / Service | Priority | RTO | RPO | Recovery Notes |
|---|
10. Testing, Maintenance & Review
- Review this plan annually or after any material cybersecurity incident.
- Validate emergency contacts and insurance information quarterly.
- Conduct tabletop exercises at least annually.
- Update playbooks when systems, vendors, tools, or compliance obligations change.
Revision History
| Date | Version | Owner | Change Summary |
|---|