Incident Response Plan Template 2026: A Step-by-Step IR Playbook

Why You Need a Tested IR Plan

The $2.66 Million Statistic: IBM's 2025 Cost of a Data Breach Report found that organizations with an incident response team AND regularly tested IR plan experienced breaches that cost $2.66 million less on average ($3.26M vs $5.92M).

The 6-Phase IR Framework

Based on NIST SP 800-61r3 (Computer Security Incident Handling Guide):

Phase 1: Preparation

Phase 2: Detection & Analysis

Severity Classification:

Phase 3: Containment

Short-Term Containment (Stop the Bleeding):

• Isolate affected systems from network (don't power off)
• Block attacker IPs at firewall/WAF
• Disable compromised accounts
• Revoke compromised API keys and tokens
• Activate pre-defined containment playbooks

Long-Term Containment (Stabilize):

• Apply emergency patches
• Rebuild compromised systems from clean images
• Reset all potentially compromised credentials
• Deploy additional monitoring on affected segments
• Establish clean communication channel for IR team

Phase 4: Eradication

• Remove all traces of attacker access (backdoors, persistence mechanisms)
• Scan environment for indicators of compromise (IoCs)
• Verify attackers are fully evicted before restoration
• Update all security tools with new IoCs

Phase 5: Recovery

• Restore systems from verified clean backups
• Monitor restored systems intensively for 30 days
• Gradually return to normal operations
• Verify data integrity
• Re-enable user access in stages

Phase 6: Post-Incident Review

Blameless Post-Mortem Template:

Communication Templates

Internal Notification (SEV-1)

SUBJECT: [CONFIDENTIAL] Security Incident - SEV-1 - [Date/Time]

SITUATION: A potential security incident has been detected involving 
[brief description]. The IR team has been activated.

IMPACT: [Affected systems/data]. [Number of users potentially affected].

CURRENT STATUS: Containment in progress. [What's being done right now].

ACTIONS REQUIRED:
- Do NOT discuss this incident outside the IR team
- Do NOT contact the media
- Direct all inquiries to [IR Lead name]

NEXT UPDATE: [Time] or sooner if situation changes.

IR Lead: [Name] - [Phone]

Customer Notification

Subject: Important Security Notice from [Company]

Dear [Customer],

We are writing to inform you of a security incident that may have 
affected your information. 

What happened: [Brief, factual description]
When: [Date discovered, estimated date of incident]
What information was involved: [Specific data types]
What we're doing: [Actions taken and ongoing]
What you can do: [Password reset link, monitoring suggestions]

We sincerely apologize for this incident. We are committed to 
protecting your data and have taken steps including [specific measures]
to prevent future incidents.

For questions: [Dedicated support line] | [Support email]

Legal and Regulatory Notification Requirements

IR Tabletop Exercise

Run quarterly tabletop exercises using these scenarios:

1. Ransomware attack — All systems encrypted, ransom demanded
2. Insider data theft — Employee downloaded customer database before resignation
3. Supply chain compromise — Vendor SDK compromised, customer data potentially exposed
4. Cloud breach — Misconfigured S3 bucket found by researcher, unknown exposure duration
5. Account takeover wave — Credential stuffing attack compromising thousands of user accounts

Further Reading

• NIST SP 800-61r3 — Incident handling guide
• Ransomware Defense Playbook — Ransomware-specific IR
• IBM (2025), "Cost of a Data Breach Report" — IR plan ROI statistics
• GDPR & CCPA Compliance — Breach notification requirements