Bug Circuit

Free tool · no signup

Incident response plan template generator

Fill in who is in charge and who to call, pick the situations you want covered, and get a short plan your team can follow on the worst day, in Markdown you can paste into any document.

By the Bug Circuit security team · Last updated

Your business

Playbooks to include
  • Add your company name.
  • Name the incident lead. Someone must own the decisions.
Your incident response plan (Markdown)
Add your company name and an incident lead.
  • Add a phone number for the incident lead. Email may not work during an incident.
  • Name a deputy. The lead will be on holiday or ill at some point.
  • No insurer listed. If you have cyber insurance, put the claims phone number here, because policies often require quick notice.
  • This is a starting template, not legal advice. Check the notification rules that apply to you, and have your insurer and lawyer read it.
What is an incident response plan? A short written plan that says who decides, what to do in the first hour, who to tell and how to recover when something goes wrong. This generator builds one for a small business, with playbooks for a hacked site, ransomware, phishing, a lost device and a data breach.

How it works

Why a small business needs one

During an attack people lose time deciding who is in charge, unplug the wrong things, wipe the evidence and forget to call the insurer, and the first hours decide how bad it gets. A plan fixes those decisions in advance. It also helps with insurers, customers and auditors, who increasingly ask whether you have one. It does not need to be long: a plan people can find and follow in a crisis beats a forty-page document nobody has read.

What the generated plan contains

It follows the structure of NIST SP 800-61, the standard guide to handling incidents, in plain language: preparation (roles and contacts), detection and reporting, containment, removal and recovery, communication, and a review afterwards. It names an incident lead with authority to spend money and take systems offline, a deputy, and the people to call. It sets three severity levels so that a phishing click and a ransomware attack are not handled the same way, and a first-hour checklist that puts stopping the damage and keeping evidence ahead of cleaning up.

The playbooks are short, ordered steps for the incidents small businesses actually meet. For a hacked website: take it offline if it is hurting visitors, copy the files and logs before cleaning, find the way in, restore a clean copy, change every credential and watch for reinfection. For ransomware: disconnect, call the insurer and the responders, do not pay before taking advice, close the way in, then restore from offline backups. The others cover account takeover, a lost device and a personal data breach, including the GDPR rule of reporting within 72 hours where it applies.

Making it work

Print the contacts page and keep a copy offline, because email and shared drives may be locked. Give it to everyone, and make sure each person knows the one rule: report immediately, and no one is blamed for reporting in good faith. Once a year, run a short exercise, for example "the website has been defaced, what do we do first?", and fix what the exercise shows. The plan is a template, not legal advice, so have your insurer and lawyer read it, especially the notification section.

Worked examples

The severity table

Generated for every plan.

P1 critical: customer data lost or exposed, systems down, active attack. Start now.
P2 serious: a real compromise that is contained. Start within 4 hours.
P3 minor: a near miss or suspicious event. Review the same working day.

Deciding the level in advance stops a small event being treated like a disaster, or the reverse.

A first-hour checklist

Section 5 of the plan.

1. Write down the time and who reported what.
2. The lead decides the level.
3. Stop the damage.
4. Preserve evidence before anything is wiped.
5. Call the people who must know now.
6. Start the incident log.

Keeping evidence is step four on purpose: cleaning first destroys the clues to how the attacker got in.

The GDPR line

Ticking that you hold personal data of people in the EU or UK.

A personal data breach that poses a risk to people must be reported to the supervisory authority within 72 hours of becoming aware of it.

The plan adds this to the communication section. Other countries have their own deadlines, so check where your customers live.

Frequently asked questions

How long should an incident response plan be?
Short enough that people read it, usually five to ten pages for a small business. The contacts, the first-hour steps and the playbooks matter most.
Who should be the incident lead?
Someone with authority to spend money and take systems offline, usually an owner or a senior manager, with a named deputy. It need not be the most technical person.
Do I need cyber insurance?
It is worth considering. It pays for specialists and lost income, and many policies require you to call their responders first, which is why the plan has a place for the claims number.
Should we ever pay a ransom?
Take advice first from your insurer, a specialist and law enforcement. Payment does not guarantee recovery, can be illegal under sanctions rules, and does not remove the attacker's access.
When must a data breach be reported?
Under GDPR and UK GDPR, within 72 hours of becoming aware, to the supervisory authority, when the breach is likely to put people at risk. Other countries have different rules, so check each place your customers live.
How often should we test the plan?
Once a year with a short exercise, and after any real incident. Update the contacts whenever someone leaves.
Is the output legal advice?
No. It is a starting template, and you should have your lawyer and insurer review it.

Keep reading

My website was hacked: what to doFirst-response steps after a compromise.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing

Incident Response Plan Template Generator · Bug Circuit