cyber incident response plan template free

Enterprise Cyber Incident Response Framework

Document Control

• Document ID: [__________]
• Version: [__________]
• Effective Date: [__________]
• Review Cycle: [__________]

1. Purpose & Scope

This document establishes the standardized protocol for identifying, containing, and remediating security breaches within [Company Name]. This policy applies to all employees, contractors, and third-party vendors accessing [Company Name] information systems. Its primary objective is to minimize operational downtime, protect sensitive data, and ensure regulatory compliance.

2. Prerequisites

• Communication: Access to [Secure Messaging Platform] and [Emergency Notification System].
• Documentation: A copy of the [Business Continuity Plan] and [Asset Inventory List].
• Access: Administrator credentials for [SIEM Tool/Log Management Platform] and [Identity Provider].
• Infrastructure: Off-site, immutable backups of critical systems.

3. Roles & Responsibilities (RACI)

4. Step-by-Step Procedure

Phase 1: Identification & Triage

• Verify the alert via [Monitoring Tool Name].
• Determine the scope of the affected systems (e.g., [Number] workstations, [Number] servers).
• Categorize the incident severity: [Low / Medium / High / Critical].
• Log the initial discovery time and source of the alert in [Incident Tracking System].

Phase 2: Containment

• Isolate compromised hosts from the primary [Network Name] environment.
• Disable compromised user accounts in [Identity Provider].
• Implement temporary firewall rules to block malicious [IP Addresses/Domains].
• Capture volatile memory (RAM) and disk images for forensic analysis.

Phase 3: Eradication

• Identify the root cause (e.g., [Malware, Phishing, Unauthorized Access]).
• Remove malicious artifacts, backdoors, and unauthorized scripts.
• Patch vulnerabilities exploited during the incident.
• Perform a full-system scan using [Antivirus/EDR Tool].

Phase 4: Recovery

• Restore systems from clean, verified backups.
• Reset passwords for all affected service and user accounts.
• Monitor network traffic for signs of re-infection or lateral movement.
• Validate system integrity with [IT Operations Team].

Phase 5: Post-Incident Activity

• Conduct a Lessons Learned meeting within [Number] business days.
• Finalize the Incident Report and store it in [Secure Repository].
• Update security controls based on findings from the incident.

5. Quality Assurance, Pro-tips, and Pitfalls

• QA: Conduct quarterly tabletop exercises to test the readiness of the response team.
• Pro-tip: Establish a "Break-Glass" account that is stored physically off-site to maintain control during a total directory compromise.
• Common Pitfall: Failing to document the timeline during the heat of the moment. Always assign one team member as the "Scribe" to log events in real-time.
• Common Pitfall: Overlooking external notification requirements (legal/regulatory) until after the recovery phase.

6. FAQs

Q: How soon should we notify stakeholders of a breach? A: Notification timelines are dictated by [Relevant Regulation, e.g., GDPR/CCPA] and your internal legal counsel. Consult the legal team within the first [Number] hours of confirmed containment.

Q: Should we pay a ransom if hit by ransomware? A: [Company Name] policy strictly prohibits ransom payments. All recovery efforts must focus on restoring from verified, immutable backups.