What it contains
- Scope and what counts as an incident.
- The team, with deputies and contact details kept outside your main systems.
- Severity levels and who is called at each one.
- The steps for each phase.
- Internal, customer, regulator and press communication: who says what.
- Legal and contractual deadlines.
- Evidence handling.
- How to close and learn.
The phases
Revision 2 of NIST SP 800-61 (2012) described four phases. Revision 3, published in April 2025, supersedes it and aligns incident response with the functions of the NIST Cybersecurity Framework 2.0. The four phases remain a simple basis for writing a plan:
- Preparation: tools, contacts, training.
- Detection and analysis: confirm it, rate it, record it.
- Containment, eradication and recovery: stop it, remove the cause, restore safely.
- Post-incident activity: review what happened and improve.
Legal deadlines to include
- GDPR: 72 hours to the authority for a notifiable personal data breach.
- NIS2: early warning within 24 hours, notification within 72 hours, final report within one month.
- HIPAA: without unreasonable delay and within 60 calendar days.
- DORA: deadlines set by the technical standards for major ICT incidents.
Test it
Run a tabletop exercise at least once a year, including management and someone who will speak to customers. Update the plan with what you learn, and after every real incident.
Questions
- What is the difference between an event and an incident?
- An event is something observed, such as a failed login. An incident is an event that harms or threatens security, and calls for a response.
- Who should lead incident response?
- A named incident manager with a deputy, with authority to make decisions such as taking a system offline.