Free template

Security Incident Response Plan Template

An incident response plan with roles, scenario playbooks and notice templates, plus sheets that map your data to each notification deadline and its owner.

Edit with AI Download (.docx + .csv)

Free download · No account needed

What you get

Pack of 11 files: 6 documents, 5 spreadsheets

Security Incident Response Plan Template

How the Clocks WorkDocument
Worked Example, Stannary HealthDocument
Declaration and RolesDocument
Response Plan by ScenarioDocument
Notification TemplatesDocument
Legal and Regulatory NoteDocument
Data and Obligation MapSpreadsheet
Notification Deadline by ObligationSpreadsheet
Affected PopulationSpreadsheet
Contact and Escalation RegisterSpreadsheet
Tabletop Exercise LogSpreadsheet

Security Incident Response Plan Template

Notification Deadline register · one row

One obligation, its own starting gun, and the hours you actually have

Discovery, recorded once12:40 · Friday, December 4, 2026

Every row in the register derives from that one field. Move it and all of them move.

Trigger eventDiscovery. Not awareness, not a materiality determination, and not the date somebody signed the contract.

Clock unitCalendar hours, which are elapsed time, so the weekend counts. Calendar days and business days do not behave like this.

Duration72

DeadlineMonday, December 7, 12:40. The same time of day the window opened.

OwnerA named person, confirmed reachable at the hour the deadline falls.

Working hours actually inside the window

Nine of seventy-two. Sixty-three hours fell outside Monday to Friday, 09:00 to 18:00. The same window opened on a Tuesday holds twenty-seven, and that is the number deciding whether a weekend gets staffed.

Sorted by expiry, never by severity

At Stannary the first two deadlines were contractual notice clauses expiring Saturday lunchtime and Sunday morning, both ahead of every regulation in the file.

The securities disclosure has no deadline on day zero, because its trigger is a materiality determination nobody has made yet. What goes in the row instead is the internal deadline for making that call, and the name of whoever makes it.

Page 1 of 1220 words

How to write a security incident response plan

A security incident response plan is the short document your team follows when someone suspects an attack or a data leak. It says who can declare an incident, who leads, what to do first for each likely incident, and which notification deadlines start. A good plan names real people with backups, works out which deadlines apply before anything happens, and has been tested in a tabletop exercise.

Write it for the worst time to use it: a Friday evening, with your usual decision-maker on a plane. Anything it leaves open gets argued over while the deadlines run.

Three engineers working side by side at laptops and monitors in an office, with a whiteboard of notes behind them — Settle the roles and deadlines before the team is at the keyboards. Photo: Alvaro Reyes on Unsplash

What goes in an incident response plan

Keep it short enough to read during an incident. It needs seven parts:

The parts of a security incident response plan

Part	What it settles
Declaration and severity	Who may declare, and severity levels based on what responders can see
Roles	Who leads, investigates, communicates and tracks deadlines, each with a backup
Scenario pages	First steps, evidence to keep and the usual mistake for each likely incident
Obligation map	Every law and contract attached to each data set, filled in now
Deadline register	Each notification deadline, computed at declaration from one discovery time
Notice drafts	First notices for customers, regulators and affected people
Contacts and exercises	After-hours numbers with backups, and what each test found

Decide who declares and who leads

Let anyone declare an incident. Google's Site Reliability Engineering book says it is better to declare an incident early¹ and close it after a simple fix than to respond hours into a growing problem.

Then script the first few minutes. Whoever declares posts what they saw, records the discovery time to the minute and leads until relieved. Computing the deadlines comes next, before triage, because they decide who you wake up.

Define severity by what responders can see, and start high when scope is unknown. An incident escalation matrix sets who gets paged at each level. Give every role a backup:

Incident commander: runs the response and does no technical work
Technical lead: contains the attack and finds out what it reached
Communications owner: approves everything that leaves the company
Deadline owner: keeps the register and calls out the next expiry
Counsel: joins at declaration for serious incidents

Map your data to every deadline

Most notification duties attach to data, not to the company. For each data set, record where it lives, whose it is, how many records it holds and where those people live. Note your role too (controller, processor or business associate), which can differ within one database.

Common breach notification clocks

Rule	Starts when	Unit	Outer limit
GDPR Article 33, controller to regulator	You become aware of the breach	Calendar hours	72 hours, where feasible²
HIPAA, covered entity to individuals	Discovery	Calendar days	60 days³
HIPAA, business associate to covered entity	Discovery	Calendar days	60 days⁴
SEC Form 8-K Item 1.05, US public companies	The company decides the incident is material	Business days	4 business days⁵
US state breach laws	Set by each state	Varies	Check each state⁶ where affected people live
Customer and processing agreements	Whatever the signed clause says	Hours or days	The clause itself

These are ceilings. HIPAA also requires notice without unreasonable delay, and the GDPR without undue delay.

Under HIPAA, a breach counts as discovered once it was known or, by exercising reasonable diligence, would have been known³, so an unread alert may have started the clock. A covered entity is also treated as knowing of a breach once its agents do. If you are a business associate acting as a customer's agent, its 60 days may start when you find the breach.

Log the notice clause from every signed customer contract, not your standard template. US public companies and their subsidiaries add the SEC rule, and a cyber insurance policy may require prompt notice to the insurer.

Compute every deadline from one timestamp

Enter the discovery time once and derive every deadline from it, recomputing if an earlier signal turns up. Write the unit beside each number: calendar hours run through nights and weekends, calendar days count whole days, and business days skip weekends and holidays.

Sort by expiry, not by how serious each rule sounds, and count the working hours inside each window. A 72-hour window opened at 12:40 p.m. on a Friday holds 9 working hours, counting 9 a.m. to 6 p.m. on weekdays. Opened on a Tuesday, it holds 27.

One clock can't be computed on day one. The SEC's 4 business days start when a company decides an incident is material, a decision that must come without unreasonable delay after discovery⁵. The register holds a deadline for that decision instead, and who makes it.

ExampleA deadline register after a Friday discoveryAn illustrative example written for this guide. Names, contracts and dates are invented.

Discovery: Friday, December 4, 2026, 12:40 p.m.
Customer contract, 24 calendar hours: Saturday 12:40 p.m. (5.3 working hours).
EU processor agreement, 36 calendar hours: Sunday 12:40 a.m. (5.3 working hours).
GDPR Article 33, own EU records, 72 calendar hours: Monday 12:40 p.m. (9 working hours).
SEC Item 1.05: no date yet. Materiality decision due Monday 5 p.m., owner named.
HIPAA, notice to client clinics, 60 calendar days: Tuesday, February 2, 2027.

Contracts first. The two tightest deadlines are contract clauses, both expiring over the weekend.
Staff it on Friday. The GDPR window holds only 9 working hours, so weekend cover cannot wait.

Write a page for each likely incident

Pick four or five scenarios from your own incidents and exposure, not a generic list. Give each page the same five headings: signals, first hour, deadline changes, evidence to keep and the usual mistake.

First moves people get backwards

Scenario	Do this first	Not this
Data theft	Copy logs before they rotate, and cut off the route out	Holding notices until you have an exact record count
Ransomware	Disconnect affected machines from the network	Switching them off, or restoring before finding the way in
Stolen login	End every session, then look for new keys and sign-in methods	Only resetting the password
Insider	Preserve logs and the device, then bring in HR and counsel	Confronting the person first
Vendor breach	Get the vendor's discovery time in writing	Waiting for their investigation to finish

The Federal Trade Commission gives the same advice for any breach: take all affected equipment offline immediately, but don't turn any machines off⁶ until the forensic experts arrive.

Draft the notices, then test the plan

Draft each first notice now: what you know, what you don't and when the next update comes. Give customers your discovery time, since their own deadlines may run from it. For public status updates, use an incident status page update template.

A HIPAA notice to individuals must be written in plain language³ and give, where known, the breach and discovery dates, the information involved and the steps people should take. Under the GDPR, details for the regulator may be provided in phases², so file on time with what you know.

Then run a 90-minute tabletop exercise. Set discovery on a Friday evening, give no warning, and time how long it takes to name the first deadline and its owner. Halfway through, change the scope, since scope moves deadlines.

Get counsel's answers in writing

This guide is general information, not legal advice. Before an incident, ask a lawyer four things: which laws and contracts apply, what counts as discovery, whether you act as a customer's agent, and who decides materiality. Date each answer.

Before you call the plan ready

Everyone knows they may declare an incident
Every role has a backup with an after-hours number
Every signed contract's notice clause is in the map
Every deadline records its trigger, unit and owner
A tabletop ran in the last 12 months, and its actions are closed

After an incident, turn the alerts and chat into a postmortem report. Between incidents, answer the incident sections of customers' security questionnaires from the plan. The template on this page has the obligation map, deadline register and scenario pages ready, with sample entries.

How to use this template

Use the files as they are, or open them in River. River asks where your data lives and whose it is, and for your signed customer agreements and data processing agreements. It also asks whether a listed parent company or a cyber insurance policy applies, and for any plan or exercise notes you already have.

From what you send, River builds the obligation map and tells you which deadline in your file falls first. It also names the four questions your lawyer should answer in writing, since none of this is legal advice.

Download it or open it in River
Download six Word documents and five CSV sheets free, or open the whole template in River to work with AI.
Map your data and contracts
Fill in the Data and Obligation Map yourself, or send River your data list and signed agreements to build it.
Write your scenarios and notices
Adapt the scenario pages to incidents you could really face, and finish the notice drafts while nothing is urgent.
Test it with a tabletop
Run a timed exercise, log the minutes until someone names the first deadline, and close every action it raises.

What's in the template

River — One timestamp, seven obligations, and a weekend nobody had modeledEvery deadline below derives from a single discovery timestamp entered once. Nothing was typed in by hand.

Instrument	Trigger	Unit	Qty	Deadline	Working hrs inside
BAA notice clause, 27 of 41 customers	Discovery	Calendar hours	24	Sat Dec 5, 12:40	5.3
EU processor DPA, Havenbrook Clinics	Discovery	Calendar hours	36	Sun Dec 6, 00:40	5.3
GDPR Art 33, own EU controller records	Awareness	Calendar hours	72	Mon Dec 7, 12:40	9.0
SEC Form 8-K Item 1.05, listed parent	Materiality determination	Business days	4	Fri Dec 11	not keyed on discovery
HIPAA 164.410(b), notify the covered entities	Discovery	Calendar days	60	Tue Feb 2, 2027	plenty
HIPAA 164.404(b), covered entity to individuals	Their discovery	Calendar days	60	Tue Feb 2, 2027	plenty
HIPAA 164.408(b), Secretary, 500 or more	Discovery	Calendar days	60	Tue Feb 2, 2027	plenty

Data set	Whose	Records	Our role	Instrument	Trigger	Unit	Qty
Patient appointment records	41 clinics	141,200	Business associate	BAA notice clause	Discovery	Cal. hours	24
Patient appointment records	41 clinics	141,200	Business associate	HIPAA 164.410(b)	Discovery	Cal. days	60
Patient intake forms	41 clinics	19,100	Business associate	HIPAA 164.410(b)	Discovery	Cal. days	60
EU clinic appointment records	6 EU clinics	9,260	Processor	Processor DPA clause	Discovery	Cal. hours	36
Stannary EU staff and inquiries	Ours	2,940	Controller	GDPR Art 33	Awareness	Cal. hours	72
Any material incident	n/a	0	Registrant subsidiary	SEC Item 1.05	Determination	Bus. days	4
Payment card data	n/a	0	Out of scope	Tokenized, never stored	none	none	0

Segment	Organizations	Records	Tightest obligation
US customers with a 24h BAA clause	27	118,400	24 calendar hours
US customers with no notice clause	14	41,900	60 calendar days
EU clinics under a processor DPA	6	9,260	36 calendar hours
Stannary EU records, controller	—	2,940	72 calendar hours
Total	47	172,500

How the Clocks WorkThe three units and four triggers behind breach deadlines, and why your customer's clock may start with yours.
Worked Example, Stannary HealthA made-up health software vendor's Friday breach, with seven deadlines computed from one timestamp.
Declaration and RolesWho can declare, the first four minutes, three severity levels, five roles and the shift handover.
Response Plan by ScenarioFive scenarios, from data theft to a vendor breach, each under the same five headings.
Notification TemplatesA fill-in customer notice, what regulator and individual notices must say, and a brief for support staff.
Legal and Regulatory NoteThe four questions to settle with counsel before an incident, recorded as dated decisions.
Data and Obligation Map sheetEach data set with its system, owner, record count, your role and every law or contract that applies.
Notification Deadline by Obligation sheetEvery deadline from one discovery time, with its unit, the working hours inside and an owner.
Affected Population sheetAffected records and organizations, grouped by the tightest notice each group is owed.
Contact and Escalation Register sheetEach role's person, after-hours route, backup and how fast they answer, with a check date.
Tabletop Exercise Log sheetEach exercise with its scenario, minutes to the first named deadline, findings and actions.

Common questions

What should a security incident response plan include?

A security incident response plan should say who can declare an incident, how severity is set and who leads, with a backup for each role. Add a page for each likely incident, a map of the notification deadlines your data and contracts carry, drafted notices, an after-hours contact list and a record of tabletop tests.

Who should be on an incident response team?

Start with an incident commander, a technical lead, a communications owner, someone who tracks deadlines, and a lawyer, each with a backup. The FTC's data breach guide⁶ says the team may also include forensics, IT, operations, human resources, investor relations and management, depending on the size and nature of your company.

How often should you test an incident response plan?

Run a tabletop exercise at least once a year. Run another after anything that changes your deadlines: a contract with a tighter notice clause, a new country, an acquisition or a real incident. Track one number from exercise to exercise: the minutes until someone names the first deadline and who owns it.

How is an incident response plan different from a disaster recovery plan?

An incident response plan handles a security event: declaring it, containing it, finding out what was taken and meeting notification deadlines. A disaster recovery plan restores systems and data after any outage, against recovery time targets. Ransomware needs both, so cross-reference them. The disaster recovery plan template covers the restore side.

What is NIST's current incident response guidance?

NIST's current guidance is SP 800-61 Revision 3⁷, published in April 2025. It replaced the 2012 Revision 2 and ties incident response to the rest of an organization's cybersecurity risk management under the Cybersecurity Framework 2.0. Use it to check what your plan covers, then write the plan around your own data, contracts and people.

Is this security incident response plan template free?

Yes. Download the six Word documents and five CSV sheets with no signup. The sheets come filled in for a made-up health software company, so you can see a finished deadline register before you clear it. Edit with AI opens the same template in River, which builds the map from your own records.

What does Edit with AI do?

It opens the template in a free River workspace. River asks where your data lives and whose it is, for your signed customer agreements, and whether a listed parent or insurance policy applies. It builds the obligation map, tells you which deadline falls first and lists the questions for your lawyer. Every notice is yours to review and send.

Sources

Google SRE. “Incident Management: Key to Restore Operations.” sre.google (opens in a new tab)
EUR-Lex. “Regulation (EU) 2016/679 (General Data Protection Regulation).” eur-lex.europa.eu (opens in a new tab)
eCFR. “45 CFR 164.404 — Notification to individuals.” ecfr.gov (opens in a new tab)
eCFR. “45 CFR 164.410 — Notification by a business associate.” ecfr.gov (opens in a new tab)
Federal Register. “Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure.” federalregister.gov (opens in a new tab)
FTC. “Data Breach Response: A Guide for Business.” ftc.gov (opens in a new tab)
NIST. “SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile.” csrc.nist.gov (opens in a new tab)

Written by

Chandler Supple

Co-founder & CEO, River

Chandler has spent the last six years working in AI, building tools for millions of users and Fortune 100 companies. In 2025, he co-founded River to build a new kind of operating system for AI agents.

LinkedIn GitHub X

Reviewed by

Brian Joseff, Co-founder, River

LinkedIn X

Security Incident Response Plan Template

One obligation, its own starting gun, and the hours you actually have

Working hours actually inside the window

Sorted by expiry, never by severity

How to write a security incident response plan

What goes in an incident response plan

Decide who declares and who leads

Map your data to every deadline

Compute every deadline from one timestamp

Write a page for each likely incident

Draft the notices, then test the plan

How to use this template

Download it or open it in River

Map your data and contracts

Write your scenarios and notices

Test it with a tabletop

What's in the template

Notification Deadline by Obligation

Data and Obligation Map

Affected Population

Common questions

Sources

Chandler Supple

Related tools and templates

More free templates