Incident Response Plan
Docs + Word8 pages
Free
- Type
- Document
- Price
- Free
- Pages
- 8 · US Letter
- Style
- Corporate
- Difficulty
- Beginner
- Updated
- November 6, 2026
Every page (8)
Overview
When ransomware hits at 2 a.m., nobody should be deciding who is in charge. This incident response plan template names the roles, the order of response steps, the update cadence and the legal deadlines in eight pages, so responders act in minutes rather than debate.
The sample follows Ivywell Systems, a fictional software company: a RACI matrix, four scenarios, a ransomware playbook, a 72-hour breach notification page, a communication schedule and a tabletop plan. Replace the roles, contacts, deadlines and dates with your own.
Useful for
- Writing a first incident response plan before a security audit or a customer questionnaire
- Preparing a quarterly tabletop exercise with a clear scenario, owners and pass criteria
- Checking who must notify the regulator, customers and insurer, and by when, during a breach
What's included
- A RACI matrix for seven response tasks across five named roles
- A scenario table and impact map for ransomware, breach, takeover and phishing
- A four-step playbook (declare, contain, eradicate, recover) with an escalation path
- A legal page with regulator, customer and insurer notification deadlines
- A communication schedule by audience, with a calendar of tests and exercises
- A testing checklist and exit criteria, plus a guide page for making it yours
How to use it
- 1
Click Make a copy in Google Docs, then confirm on the Google page. The copy is saved to your own Google Drive.
- 2
Replace the severity levels, roles and deputies with your own, tying each level to customer impact and data loss.
- 3
Add every regulator, customer contract and insurer you must notify, with its deadline and the role that sends the notice.
- 4
Rewrite the scenarios and playbook for the incidents you fear, then put the date of your first tabletop on the testing page.
- 5
Delete the Make it yours page, then share the plan with your responders and on-call rota.
What you need
Requirements
- A Google account with access to Google Drive
Works with
- Google Docs
- Microsoft Word (download the .docx)
Questions
Is this incident response plan template really free?
Yes. Make a copy in Google Docs and edit it as you like. There is no sign-up on this site and no cost.
Is the sample content real?
No. Ivywell Systems, its people, email addresses and every figure are fictional and exist only to show what a finished plan looks like.
Does it replace legal advice on breach notification?
No. The 72-hour rule and contract deadlines are examples. Check your own regulators and contracts with counsel before you rely on them.
- #incident-response-plan
- #security-incident-template
- #tabletop-exercise
- #ransomware-playbook
- #breach-notification
- #google-docs
- #incident-management
Related templates
More Google Docs templatesMore developer workflows templates
Incident Commander Checklist
Docs + Word3 pages
Free
Admin Training Deck
Slides + PowerPoint11 slides
Free
