How to Write an Incident Response Plan: A Practical Guide for Mid-Market Owners and Operators

How to Write an Incident Response Plan: A Practical Guide for Mid-Market Owners and Operators

2026-10-29

An incident response plan is mostly names, phone numbers, and decisions you made in advance. If yours lives only on the network it is supposed to protect, or it works only when one IT person picks up the phone, you don’t have a plan yet. You have a hope with a file name.

Here’s how owners and operators can write one that holds up on a bad day, using free guidance from NIST and CISA.

What an incident response plan is (and isn’t)

CISA’s Incident Response Plan (IRP) Basics fact sheet (published January 31, 2024) describes it as a written document, formally approved by senior leadership, that guides you before, during, and after a confirmed or suspected security incident. It clarifies roles and includes a list of the key people you’ll need in a crisis.

It is not a 60-page binder of technical steps. Even NIST stepped away from that. NIST SP 800-61 Revision 3, finalized April 3, 2025, replaced the 2012 Revision 2 handling guide and says the details of how to perform response “change so often” that a single static publication can no longer capture them. Instead it organizes incident response around the six functions of the NIST Cybersecurity Framework 2.0: Govern, Identify, and Protect as preparation, and Detect, Respond, and Recover as the response itself (NIST Incident Response project).

Translation: your plan decides who leads, who does the work, and who talks. Technical runbooks can hang off it later.

The five sections every plan needs

1. Roles, each with a backup

CISA’s fact sheet names three core roles during an incident: an Incident Manager, a Tech Manager, and a Communications Manager. In a mid-market company that might be the COO or general manager, your internal IT lead or managed service provider, and whoever already speaks to customers.

Give every role a named backup. Add two more seats: your attorney, and the person who can approve spending money fast (an outside forensics firm doesn’t start on a handshake).

2. A contact list that works when your systems don’t

CISA’s advice is blunt: print the plan and the contact list and hand a copy to everyone with a role, because email, chat, and document storage may be down during an incident. Your list should include:

  • Your outside incident response firm (CISA recommends choosing one in advance)
  • Your attorney
  • Your cyber insurer’s claims line
  • Your managed service provider and key software vendors’ support lines
  • Your bank’s fraud line
  • Your local FBI field office, the FBI’s Internet Crime Complaint Center, and CISA’s reporting page

Keep a printed copy somewhere physical and a copy on the core team’s personal phones.

3. Severity levels and a clear trigger

Decide what counts as an incident and who is allowed to declare one. A simple three-level scale works for most companies. Here is an example, not a standard:

  • Level 1: a single phishing click with no sign of account access
  • Level 2: a confirmed compromised account or malware on one machine
  • Level 3: ransomware, data theft, payment fraud, or an outage customers notice

For each level, write down who gets called and what happens next. Ambiguity is what turns a two-hour problem into a two-week one.

4. Decisions you make now, not at 2 a.m.

Settle these in writing while everyone is calm:

  • Who can authorize disconnecting systems or taking a site offline?
  • Who calls the insurer, and when? Read your policy for notice requirements and any rules about which vendors you may hire.
  • Who engages the outside firm and the attorney? CISA notes that attorneys often have preferences on how to engage incident response vendors and law enforcement, so have counsel review the plan.
  • What is your holding statement? CISA recommends preparing press responses in advance, so that a reporter asking about stolen files gets a calm answer instead of a “no comment” that sounds like a yes.

5. A notification map

Every U.S. state, plus D.C., Guam, Puerto Rico, and the U.S. Virgin Islands, has a security breach notification law, and they differ on what counts as personal information and how fast you must notify (NCSL). Public companies have another clock: an SEC Form 8-K Item 1.05 disclosure is generally due four business days after the company determines an incident is material (rule adopted July 26, 2023).

Add the notice windows in your own customer and partner contracts. Your plan doesn’t make the legal call; it makes sure counsel hears about the incident early enough to make it.

Keep it alive

CISA recommends reviewing the plan quarterly, rehearsing it with a tabletop exercise (a facilitated walk-through of a made-up incident), and holding a blameless retrospective after every real incident to update procedures. NIST’s Revision 3 builds the same loop in: lessons learned feed back into every function.

Also update the plan whenever a named person leaves, you change managed service providers, or you add a major system.

The one-minute test

Ask your leadership team five questions:

  1. Who is in charge if the IT lead is on a plane?
  2. Where is the printed contact list?
  3. Who can approve shutting off the internet connection?
  4. What is the insurer’s claims number?
  5. Who drafts the customer notice?

If any answer takes more than a minute, start there.

The bottom line

A good incident response plan is short, printed, approved by leadership, and rehearsed. Most of the value comes from decisions made before anything goes wrong.

A written incident response plan and a tabletop exercise with leadership are part of the Chief Information Security Officer work Yellow Coop offers. If you’d rather not start from a blank page, see what we do and how we engage, or get in touch.

Sources