IT and security / Free editable template

Cyber incident response plan template

An incident response plan tells everyone what to do in the first hours of a cyber attack, when there is no time to work it out. This example follows the NIST lifecycle from detection to recovery, with a triage decision, separate routes for high and lower severity, an escalation table and a list of contacts to fill in before you need them.

Use this template →See the example ↓

No account needed · Opens as your own editable page

Preview the cyber incident response plan

View full-size preview ↗
Cyber incident response plan example showing nist lifecycle from preparation to recovery, triage and severity routes, escalation matrix and contacts
Everything in this example is editable. Replace the labels, move the shapes and adapt the layout to your work.

How to use this template

  1. Fill in the contacts now

    Add names and out-of-hours numbers for the incident lead, legal, communications, your IT provider and your cyber insurer. Many insurers ask to be called first.

  2. Agree severity levels

    Write examples for each severity so the person on call can decide quickly, and set who must be told and how fast.

  3. Rehearse it

    Run a tabletop exercise with a realistic scenario such as ransomware. Fix the gaps it shows before a real incident does.

Questions about this template

Can I add our own contacts to the plan?

Yes. Edit the escalation matrix and contacts with your names, roles and phone numbers, and match the severity routes to your policy.

Do I need an account to use it?

No. Open the template and edit it in your browser. Your work saves on this device. An account is optional if you want to sync your workspace.

Can I export the finished diagram?

Yes. Use Export in the editor to save a PNG, SVG or PDF, or download an editable .epicdraw backup.

More IT and security templates →