# Incident Response Plan Template, Word and PDF Source: https://nerix.ai/templates/incident-response-plan Buy to download This page shows a preview. Buy the document on nerix.ai to download it as Word and PDF and print it. https://nerix.ai/templates/incident-response-plan # Incident response plan Decide before it happens who does what when a security or system incident strikes. Before you send it Many countries require you to tell the authorities and the people affected within a set time after a breach of personal data, and some sectors have their own duties. Check the rules and the contracts that apply to you, and put the real deadlines in section 6. ## Fill it in and preview You are signed in. Fill it in your workspace and it is kept as a document you can send, share and have signed. [Open in your workspace](https://app.nerix.ai/documents/templates/incident-response-plan) **€4.99, pay once, Word and PDF** Included in every paid nerix plan. ### Incident response plan **Company:** Brightwater Analytics Ltd **Version:** 1.0, 1 February 2027 **Owner:** Head of IT ## 1. Purpose and scope This plan tells Brightwater Analytics Ltd how to find, contain and recover from an incident that harms the safety, availability or privacy of our systems and data. It covers: Customer portal and database Office network and laptops Email and file storage Payment systems An incident is any event that damages or threatens these, for example malware, a stolen account, a lost device, a data leak, an attack that takes the service down or an unauthorised change. ## 2. Team and contacts **Incident lead:** Sana Malik, IT manager, +353 1 555 0100 Technical lead: Jin Park, +353 1 555 0101 Communications: Priya Nair, +353 1 555 0102 Legal and privacy: Owen Clarke, +353 1 555 0103 Management: Maria Silva, +353 1 555 0104 The incident lead decides, leads the response and keeps the log. If the lead cannot be reached, the technical lead takes over. 3. Severity levels 4. Response steps 5. Backups and recovery 6. Telling others 7. Evidence and records ⁦2 / 2⁩ The full document unlocks when you download The rest is written and waiting, with your answers in place. Templates are a careful starting point, not legal advice. Where the law matters, check what applies where you are. IT and projects ## What this template is for An incident response plan for IT and security incidents: roles, severity levels, steps from detection to recovery, who to tell and review. Word or PDF. It is free to fill in online and needs no account. The finished Word document and PDF cost €4.99, paid once. [See all IT and projects templates](https://nerix.ai/templates/it-projects) IT and projects ## What you fill in The form asks for 11 details. The document fills itself in as you type. - ### Company name For example: Brightwater Analytics Ltd - ### Version and date For example: 1.0, 1 February 2027 - ### Plan owner For example: Head of IT - ### Systems and data in scope For example: Customer portal and database Office network and laptops Email and file storage Payment systems - ### Incident lead For example: Sana Malik, IT manager, +353 1 555 0100 - ### Response team and contacts Name, role and a phone number that works out of hours. One per line. For example: Technical lead: Jin Park, +353 1 555 0101 Communications: Priya Nair, +353 1 555 0102 Legal and privacy: Owen Clarke, +353 1 555 0103 Management: Maria Silva, +353 1 555 0104 - ### Severity levels For example: High: customer data exposed or the main service down. Act at once; tell management within 1 hour. Medium: one system affected, no known data loss. Act within 4 hours. Low: a failed attack or a minor fault. Log and review within 2 working days. - ### Who must be told, and by when Use the real deadlines from the law and your contracts. For example: Data protection authority: within 72 hours of learning of a personal data breach, if the law applies Affected people: without undue delay if there is high risk to them Insurer: within 24 hours Main clients: as their contracts say - ### Outside help (optional) optional For example: Forensics firm CyberAid, 24 hour line +44 20 7946 0100; cyber insurer policy 8841 - ### Backups and recovery For example: Daily encrypted backups stored in a second region and tested every quarter. Recovery target: 4 hours for the portal. - ### How often the plan is tested For example: a table-top exercise every 6 months IT and projects ## What is inside The parts of this document, in order. - 1 1. Purpose and scope - 2 2. Team and contacts - 3 3. Severity levels - 4 4. Response steps - 5 5. Backups and recovery - 6 6. Telling others - 7 7. Evidence and records - 8 8. Training and testing - 9 9. Review Templates ## How it works - 01 ### Fill in Type your details in the form. The document fills itself in as you type; click any gap to jump to its field. - 02 ### Check Read it through. Gaps you have not filled stay marked, so nothing goes out half done. - 03 ### Download Pay once and get it as a Word document to edit further and as a PDF to send or print. The link comes by email too. ### Was this template helpful? IT and projects ## Questions people ask ### What details does this template ask for? The form asks for 11 details, starting with Company name, Version and date, Plan owner, Systems and data in scope, Incident lead. 1 more are optional. ### How much does this template cost? €4.99, paid once. Filling it in and seeing the first part is free. You pay when you download the finished Word document and PDF, with no account and no subscription. Every paid nerix plan includes it. ### Can I download this template as Word or PDF? Yes. When you have filled in the form, press Download and pay once. You get the finished document as a Word file to keep editing and as a PDF to send or print, and the link by email. ### Is what I type sent anywhere? While you fill it in, what you type stays in your browser. When you buy the document, your answers go to nerix to make your files. They are kept for seven days so you can download again, then deleted. ### What should I check before I use this template? Many countries require you to tell the authorities and the people affected within a set time after a breach of personal data, and some sectors have their own duties. Check the rules and the contracts that apply to you, and put the real deadlines in section 6. ### Are these IT and project templates free? Most are. Fill in and download them for free as Word or PDF, with no account. A few longer documents are premium: free to fill in, paid once to download, and marked with their price. ### Does a security policy make us secure? No document does that alone. A policy helps when it matches what people really do, so keep it short, explain it to your team and review it every year. ### Is a project charter only for large projects? No. A small project benefits too, because one page that names the goal, the limits and the decision maker prevents most arguments later. Templates ## More in IT and projects - [API integration specification Specify how two systems connect: what data moves, how it is secured, how errors are handled and who owns it. IT and projects](https://nerix.ai/templates/api-integration-specification) - [Architecture decision record Record a technical decision with its context, options, reasons and consequences, for the team to find later. IT and projects](https://nerix.ai/templates/architecture-decision-record) - [Bring your own device policy Set the rules for using personal phones and laptops for work: security, privacy, support and leaving. IT and projects](https://nerix.ai/templates/byod-policy) - [Bug report Report a software problem so a developer can repeat it, judge its impact and fix it. IT and projects](https://nerix.ai/templates/bug-report) - [Change management plan Plan how people will be told, trained and supported through a big change, and how you will know it worked. IT and projects](https://nerix.ai/templates/change-management-plan) - [Change request Ask for a change to a project or system, show its impact and record whether it is approved. IT and projects](https://nerix.ai/templates/change-request) [See all IT and projects templates](https://nerix.ai/templates/it-projects) Templates ## More kinds of documents Every category has its own page, so you can see all of its templates at once. ## Use it in nerix ### Use it in nerix - [Templates](https://nerix.ai/product/templates) - [Long tasks](https://nerix.ai/product/tasks) - [Long documents](https://nerix.ai/product/long-documents) ### Learn more - [How to Make a Document From a Template](https://nerix.ai/help/make-a-document-from-a-template) - [IT and projects](https://nerix.ai/templates/it-projects) ## Keep reading - Quality and audits iso [Quality and audits](https://nerix.ai/blog/category/quality-and-audits) November 1, 2026 7 min read ### [ISO 27001 for small teams, a 90 day plan](https://nerix.ai/blog/iso-27001-for-small-teams) ISO 27001 for small teams in plain steps. Who does what, how to scope it, a 90 day plan to audit readiness, what to skip and how certification works. Read the guide - Quality and audits nis2 [Quality and audits](https://nerix.ai/blog/category/quality-and-audits) November 1, 2026 7 min read ### [NIS2 checklist for small companies](https://nerix.ai/blog/nis2-checklist-for-small-companies) A NIS2 checklist for small companies. See if the directive applies, the ten Article 21 security measures and the 24 hour, 72 hour and one month deadlines. Read the guide - [Quality and audits](https://nerix.ai/blog/category/quality-and-audits) October 25, 2026 7 min read ### [ISO 27001 checklist for small businesses](https://nerix.ai/blog/iso-27001-checklist-for-small-businesses) An ISO 27001 checklist for small businesses, with the documents the standard asks for, the Annex A controls, the evidence auditors sample and tool prices. Read the guide