# What should an incident response plan contain?

Less than most templates suggest, as long as it works under stress. The essentials fit on two or three pages: who leads and who deputises, the phone numbers of the people and providers you will call, when you isolate a system or cut the company off from the internet, where the backups are and how to restore the most important systems, and who decides on reporting to the CSIRT, the data protection authority, insurers and customers, with their deadlines. Add a short checklist for the first hour and a template for the incident log. Print it, because the file server holding the plan may be the one that gets encrypted. Review it after every incident and at least once a year. NetSenX tracks the NIS2 Article 23 deadlines per incident and keeps an audit log of alerts and analyst decisions, which supports the reporting part of the plan.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/what-should-an-incident-response-plan-contain

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Who should be on the incident team in a small company?](https://netsenx.com/en/faq/who-belongs-on-a-small-company-incident-team)
- [What is an incident response retainer, and do we need one?](https://netsenx.com/en/faq/what-is-an-incident-response-retainer)
- [What is a tabletop exercise, and how do we run one?](https://netsenx.com/en/faq/what-is-a-tabletop-exercise)
- [What is the difference between an event, an alert and an incident?](https://netsenx.com/en/faq/difference-between-an-event-an-alert-and-an-incident)
- [How do we tell a real incident from a false alarm?](https://netsenx.com/en/faq/how-to-tell-a-real-incident-from-a-false-alarm)