Free Incident Response Plan Template & Builder

The basics

Company name

Who owns this plan? A named person, not a department. Somebody has to keep it current.

Last reviewed

First response

Who is notified first? Name, phone and email. The phone number is the point: email may be the thing that is down.

If they cannot be reached

Where does the team coordinate? Name a fallback that does not depend on your own infrastructure.

Who can declare an incident? Lowering this bar is usually right. Late declaration is the common failure.

Severity

Two or three levels is plenty. Edit these to match how you actually talk.

Critical

Major

Minor

Telling people

When do customers get told?

Regulator notification Timescales differ by jurisdiction. Write down the one that applies to you.

Who speaks publicly?

Afterwards

Post-incident review

Where is evidence kept? Auditors ask for this. Deciding it now is easier than reconstructing it later.

Your plan

Saved in this browser as you type. Download a copy to keep it somewhere your team can reach during an outage.

Questions people ask about this

What should an incident response plan contain?

At minimum: who is notified first and how to reach them, how severity is judged, who can declare an incident, where the team communicates during one, when customers and regulators must be told, and what happens afterwards. One page covering those honestly is worth more than twenty pages of generic text.

Is a one-page incident response plan enough for SOC 2?

An auditor is looking for evidence that a documented, followed process exists - not length. A short plan that names real people, real channels and real timescales is more credible than a long template with placeholders left in. What matters is that it is written down, current, and that the team knows it.

How often should the plan be reviewed?

At least annually, and after any real incident or near miss. The parts that go stale fastest are the contact details and the names, which is exactly the part that matters at two in the morning.

Does anything I enter get sent to Trufend?

No. The plan is assembled in your browser and saved only in your own browser storage. Nothing is transmitted. Use the download button to keep a copy.