When an incident hits, teams lose minutes arguing about who is in charge and how bad it is. This plan settles that in advance. It defines scope, four severity levels tied to customer impact, a RACI matrix with one accountable person per task, the four response steps, an update schedule by audience and a post-incident review.

The sample is the plan for Netherby Labs, with response times of 5, 15 and 60 minutes and the next business day, updates every 30 minutes for SEV1, and a 72-hour regulator clock. It includes a worked review of a credential leak. Replace the severity table, role holders, contacts, deadlines and scenarios with your own.