Incident Response Plan
Docs + Word8 pages
Free
- Type
- Document
- Price
- Free
- Pages
- 3 · US Letter
- Style
- Corporate
- Difficulty
- Beginner
- Updated
- November 6, 2026
Every page (3)
Overview
During a major incident the first fifteen minutes decide how calm the next three hours are. This three-page checklist gives an incident commander one place to confirm severity, name the four roles, set the update rhythm, record who decides what and close the call with a review date.
The sample shows Valemont Software running a SEV1 call: a RACI for seven tasks, a four-step flow from declaration to close-out and a three-step escalation path with a 72-hour regulator rule. Replace the roles, times and thresholds with your own, then print it or pin it to the bridge.
Useful for
- A commander opening a bridge call who needs the first steps and role names in front of them
- An on-call rota where each new commander gets the same rules for severity, updates and handover
- A quarterly tabletop exercise that walks the team through declaring, deciding and closing an incident
What's included
- A RACI matrix for seven incident tasks across five roles, with a legend for R, A, C and I
- Definitions of the commander, communications lead and scribe
- A four-step response flow with the current step highlighted
- An escalation path for rollback decisions, spending and regulator notice
- A guide page with five steps for replacing the sample content
How to use it
- 1
Click Make a copy in Google Docs, then confirm on the Google page. The copy is saved to your own Google Drive.
- 2
Replace the five roles in the RACI with your own role names, then adjust each R, A, C and I so every task has exactly one A.
- 3
Set your update cadence and response times in the flow, and write your own thresholds in the escalation steps.
- 4
Add the regulators and customers you must notify, with the deadline for each, and name a date for the next tabletop exercise.
- 5
Delete the guide page, then print the checklist or share the link with everyone on the on-call rota.
What you need
Requirements
- A Google account with access to Google Drive
Works with
- Google Docs
- Microsoft Word (download the .docx)
Questions
Does the checklist assign tasks to named people?
No. It assigns tasks to roles such as the incident commander and scribe, so the checklist works whoever is on call and handovers stay simple.
Are the figures and the company real?
No. Valemont Software, its roles, thresholds and dollar amounts are fictional and only show what a finished checklist looks like. Use your own numbers.
Can I use it for security incidents as well as outages?
Yes. The roles, cadence and escalation steps apply to both. Add the legal and regulator deadlines that apply to you, such as the 72-hour rule, on the escalation step.
- #incident-commander
- #incident-checklist
- #incident-response
- #raci
- #on-call
- #google-docs
- #major-incident
Related templates
More Google Docs templatesMore developer workflows templates
Cyber Incident Response Plan
Docs + Word8 pages
Free
Admin Training Deck
Slides + PowerPoint11 slides
Free
