What should an incident response plan contain?

Less than most templates suggest, as long as it works under stress. The essentials fit on two or three pages: who leads and who deputises, the phone numbers of the people and providers you will call, when you isolate a system or cut the company off from the internet, where the backups are and how to restore the most important systems, and who decides on reporting to the CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported., the data protection authority, insurers and customers, with their deadlines. Add a short checklist for the first hour and a template for the incident log. Print it, because the file server holding the plan may be the one that gets encrypted. Review it after every incident and at least once a year. NetSenX tracks the NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. Article 23 deadlines per incident and keeps an audit log of alerts and analyst decisions, which supports the reporting part of the plan.

← All 60 questions on Incident responseAll topics