Skip to content
AuditFront
ISO 27001docx

Incident Response Plan Template

Draft your incident response plan in Word, with roles, severity levels, response steps, communication prompts and three exercise scenarios.

Updated

No account required · Autosaves in this browser for 30 days · Sign up only to keep it

What's Inside

Document ownership, approval and review fields
Example incident severity table
Incident response roles and contact-list placeholders
Six phases of response procedures
Internal escalation, regulator and customer communication drafts
Ransomware, insider theft and supply-chain exercise scenarios
Reference table for notification deadlines to verify for your scope

About This Template

The document provides sections for preparation, identification, containment, eradication, recovery and lessons learned. It includes example severity levels, a response-team contact list and draft communication formats. Use these to agree how your own team will make decisions during an incident.

Before approving the plan, replace the sample response times and contact details with arrangements your team can meet. Identify who may isolate a production system, involve external responders, notify customers and approve recovery. Check that the decision maker and their deputy can be reached outside normal working hours.

Verify reporting thresholds, deadlines and recipients against the law and contracts that apply to the incident. The reference table is a prompt for that work, not a complete reporting procedure. Rehearse a scenario using the actual contact list and record where the plan failed: unavailable people, missing access, unclear authority or information nobody could find. Revise those sections before the next exercise.

The download is available without an account or email address. Keep a working copy, record who completed the review and retain the evidence used to reach each decision. The online assessment is a separate way to organise your review; downloading this file does not create an assessment in the app.

Who It's For

CISOs and security teams building or updating their organization's incident response capabilitiesCTOs at startups who need to establish incident response procedures before their first ISO 27001 auditIT managers responsible for detecting and responding to security incidentsCompliance officers ensuring incident response procedures meet regulatory notification requirementsDevOps and SRE teams who need to integrate security incident response with operational incident management

How It Works

1

Open the assessment

Open the ISO 27001 assessment in AuditFront. No account is required.

2

Answer and see gaps

Work through each question and see your score, findings, and priorities.

3

Save your work

Your work autosaves for 30 days. Create a free account only to keep it or use another device.

Frequently Asked Questions

What should I fill in before the first exercise?
Confirm incident contacts, escalation authority, severity definitions and communication approvals. Check that responders can access the plan if normal systems are unavailable.
Are the communication templates ready to send?
They are drafts. Adapt them to the incident, recipient and applicable obligations, and have the appropriate person approve the message.
How can I test the plan?
Use one of the included tabletop scenarios. Walk through decisions with the people named in the plan, record missing information and assign follow-up actions.

Ready to see where you stand?

Work through the ISO 27001 assessment, record supporting evidence and review the gaps in your answers.

Start free ISO 27001 assessment

No account required · Autosaves for 30 days · No credit card