Skip to content
3rd Element Consulting

Resource

Incident Response Plan Template for Small and Mid-Sized Businesses

A free incident response plan template you can fill in for your business. It covers roles, notification steps, and the decisions that need to be made before an incident, not during one. Co-branded with DataStream Insurance, our cyber insurance partner.

An incident response plan template is a fill-in document for deciding ahead of time who does what when a security incident hits: who leads, who gets called and in what order, who talks to clients, and which decisions get made in the first few hours. Cyber insurance carriers now commonly expect a written incident response plan, and it is far easier to write one on a calm day than during an incident.

Dawn SizerDawn Sizer · CEO and Co-Founder, 3rd Element Consulting ·
Schedule an IT Environment Review

What a good incident response plan covers

  • Who leads. One person in charge during an incident, plus a backup if they are out.
  • Who gets called, and in what order. Your IT provider, your cyber insurance carrier, your attorney, and anyone else who needs to know early.
  • Decisions made in advance. Who can approve disconnecting systems, who can approve outside help, and who speaks for the company.
  • Client and regulator notification. Who decides whether notification is required, and who handles it.
  • Contact information that works when email does not. Phone numbers, policy numbers, and claim lines kept somewhere you can reach during an outage.

The template gives you a structure to fill in for each of these, written for a business without a full-time security team.

Free template

Download the Incident Response Plan Template

A practical IRP template you can fill in for your firm, covering roles, notification steps, and the decisions that need to be made before you need them.

Why write it before anything happens

During an incident, people make fast decisions with incomplete information. Deciding the important ones ahead of time removes a lot of that pressure.

Many cyber insurance policies have specific requirements for what happens after an incident, such as calling the carrier first or using approved response firms. Knowing those requirements before something happens can protect your coverage. Check your policy, or ask your broker, while you fill in the template.

A written plan is also one of the things carriers ask about on applications and renewals, so having one helps beyond the day you need it.

How to fill it in

  1. Get the right people in one room: leadership, your IT provider, and whoever handles client communication.
  2. Fill in names and a backup for every role.
  3. Add the contacts: your insurance carrier's claim line and policy number, your IT provider, your attorney, and your broker.
  4. Agree on the first-hour decisions, such as who can approve shutting systems down.
  5. Keep a printed or offline copy. If email and file shares are down, an online-only plan does not help.

Review it once a year, and whenever a key person leaves or your insurance changes.

What to do with it next

  • Share it with leadership so everyone knows their role before they need it.
  • Give a copy to your IT provider and your insurance broker.
  • Walk through one scenario as a team once a year. A one-hour tabletop exercise will show you where the plan has gaps.
  • Pair it with recovery planning. Our guide to why backup is not recovery covers what comes after the first hours.
Schedule an IT Environment Review

Common questions

Questions leadership usually asks first.

What is an incident response plan?
A written plan for what your business does when a security incident happens, such as ransomware, a compromised email account, or a data breach. It covers who leads, who gets called, what decisions get made, and how clients and regulators are notified.
What is the difference between an incident response plan, a disaster recovery plan, and a business continuity plan?
An incident response plan covers the first hours of a security incident and who does what. A disaster recovery plan covers getting systems and data back. A business continuity plan covers keeping the business running while that happens. Most businesses need all three, and they should point to each other.
Does cyber insurance require an incident response plan?
Many carriers now ask whether you have a written incident response plan on applications and renewals. Requirements vary by carrier and policy, so check your application or ask your broker.
Who should be on the incident response team at a small business?
Usually the owner or another executive, your IT provider, someone responsible for client communication, and outside contacts such as your attorney and insurance broker. At a small business, one person may cover more than one role, which is fine as long as everyone has a backup.
Is the template free?
Yes. Enter your name, work email, and company to download it.

Continue reading

Related work and reading.

Backup is not recovery.

Having backups is not the same as knowing the business can actually recover. The gap between the two is where most disasters live.

Read more: Backup is not recovery.

What is an IT disaster recovery plan?

Most businesses find out their disaster recovery plan is incomplete on the day they need it. Here's what a real one contains, how it differs from a backup plan and a business continuity plan, and how to build one that works when it matters.

Read more: What is an IT disaster recovery plan?

How to Build a Business Continuity Plan That Actually Works

Most businesses have some version of a continuity plan sitting in a drawer or a shared folder nobody's opened since it was written. A real plan isn't a document you write once and file away. It's a tested, current answer to a specific question: if something takes your systems down, what actually happens next?

Read more: How to Build a Business Continuity Plan That Actually Works

Cyber insurance requirements in 2026, in plain language.

What insurers are actually asking, what they verify, and how to answer with evidence instead of a guess.

Read more: Cyber insurance requirements in 2026, in plain language.

Next step

Want help filling it in?

Schedule an IT Environment Review. We will walk through your plan with you and point out the gaps.

Schedule an IT Environment Review