6 Steps to creating an incident response plan
There are several resources that can help you develop your incident response plan. In addition to NIST, there is SANS Incident Management, which emphasizes preparation, identification, containment, eradication, recovery, and lessons learned. CISA also offers a useful cheat sheet of Incident Response Plan (IRP) Basics.
Whatever method you choose, below are six important steps your cybersecurity incident response plan should cover:
Step 1: Preparation
Preparation is key to an effective response. Start by developing a policy for how you will manage your incident response, what actions must be prioritized, and who will lead incident handling. Keep the plan simple and not too detailed because you'll need to share it with business executives to get their agreement and support.
Next, assemble your incident response team. Because cyberattacks have far reaching business, operational, customer, and regulatory impacts, include stakeholders from various disciplines including IT, management, legal, HR, and communications/public relations. To ensure buy-in, explain why cybersecurity incident response matters, each individual’s role and responsibilities in the event of an incident, and how an effective plan can help everyone prepare to handle any cyber threats or data breaches.
If you have a global team, you may want to create decentralized teams for each region, each reporting to a single incident response leader.
It’s also a best practice to assign a specific person to be in charge of communicating with your management team. This may be a CISO or other business leader. The key is to have someone who can convey updates about incident response in language the C-suite and board will understand.
Revisit your policy and procedures frequently and ensure that your incident response team is regularly trained and prepared to respond.
Step 2: Identification and analysis
Take steps to put security safeguards in place. This way, you can quickly determine if your organization is vulnerable or has already been attacked, so you can take action to prevent further harm.
For example, attack surface analytics and continuous monitoring can pinpoint vulnerabilities in your network that attackers look to exploit and help prioritize the most critical risks for proactive remediation. To detect and analyze a potential breach, layer in endpoint monitoring, firewalls, intrusion detection, and security incident event management (SIEM) tools.
Step 3: Containment, eradication, and recovery
During this phase, the incident response team is focused on mitigating the effects of an incident. To understand what systems are affected, look to your security management tools for intelligence and indicators of compromise, then shut down or isolate these devices, address the root cause, and restore systems.
This phase is guided by how critical the data or assets are, how severe the incident is, and business continuity imperatives. Here, you can score incidents (i.e. incident classification) based on the impact they may have on your operations, the systems or data at risk, and the ability to recover.
Don’t forget to include a process for documenting the actions you take and any evidence of compromise collected. This will be instrumental in the next step of your incident response plan and future incident response process planning.
Step 4: Post-incident activity
After any cybersecurity incident, hold a post mortem meeting to discuss what happened and your organization’s response, including what worked, what didn’t, and what can be improved. Position it as an open and blameless forum for sharing lessons learned with senior leaders and stakeholders. Invite input and feedback on how the organization can be better prepared if or when another incident occurs.
Document when reviews should take place, who should participate, and how findings will be recorded. Include representatives from security operations, IT, risk management, and other business functions involved in the incident.
Your review procedures should address:
- Incident timeline: When suspicious activity began, how the incident was detected, and how the response progressed
- Response effectiveness: Whether teams followed established procedures, escalated the incident appropriately, and coordinated containment and recovery
- Business impact: Which systems, data, services, and third parties were affected, and how the incident disrupted operations
- Security gaps: Vulnerabilities, control weaknesses, visibility gaps, or process failures that contributed to the incident
- Response performance: Metrics such as mean time to detect (MTTD), time to contain, and time to recover
Post-incident reviews should also evaluate whether internal communications, evidence preservation, and applicable notification procedures worked as intended.
If your organization is subject to regulations that require reporting of cyber incidents, such as the U.S. Security and Exchange Commission’s (SEC) new cybersecurity disclosure requirements, factor this into your post-incident activity. SEC rules require publicly traded companies to disclose any “material” cybersecurity incident within four business days. Read more about what a “material” cybersecurity incident is and best practices for incident disclosure.
Step 5: Test your incident response process
Don’t wait until an incident occurs to test your incident response plan. Conduct regular drills and simulation exercises. Testing helps identify weaknesses in detection, communication, escalation, and recovery before a real incident puts those processes under pressure. For instance, one month you can have your incident response team simulate their response to a ransomware attack, and in the following month, shift your focus to another security event, such as a supply chain cybersecurity attack.
Establish a testing schedule based on your organization's risk profile, operational complexity, and applicable requirements. Use different types of exercises to evaluate both technical capabilities and cross-functional coordination.
Your testing program should evaluate whether teams can:
- Identify and classify potential security incidents
- Escalate threats to the appropriate decision-makers
- Coordinate containment and remediation activities
- Communicate with internal stakeholders and affected third parties
- Restore critical systems according to recovery priorities
- Document response activities and preserve relevant evidence
Include scenarios involving critical vendors and external service providers to assess how effectively security operations and third-party risk management teams coordinate during supply chain incidents.
Step 6: Lessons learned and continuous improvement
Incident response planning is an ongoing process. As your organization adopts new technologies, expands its digital footprint, and encounters emerging threats, its response procedures must evolve.
Use findings from post-incident reviews and response exercises to identify improvements to your incident response plan. Prioritize corrective actions based on the severity of identified gaps, the criticality of affected systems, and potential business impact.
For example, an incident investigation may reveal that teams lacked visibility into a vulnerable internet-facing asset or that unclear escalation procedures delayed containment. Address these findings by updating asset inventories, strengthening monitoring processes, clarifying responsibilities, or revising response playbooks.
Establish a process for tracking improvement initiatives, assigning accountability, and measuring progress. Periodically review the plan to ensure it reflects organizational changes, new threat intelligence, and lessons from previous incidents.
Continuous exposure monitoring and threat intelligence can help security teams identify emerging vulnerabilities and threat activity that may require updates to incident response procedures. These insights also help organizations prioritize remediation and communicate evolving cyber risk to business leaders.
By translating lessons learned into documented changes, measurable actions, and regular testing, organizations can improve incident response readiness and strengthen cyber resilience over time.
Incident response planning FAQs
What does an incident response plan allow for?
An incident response plan allows organizations to respond to cyber security events quickly, consistently, and effectively. By outlining predefined roles, procedures, and communication strategies, the plan enables teams to contain threats, minimize damage, and recover faster. It also helps reduce uncertainty and ensures compliance with regulatory or contractual obligations, which is critical when managing IT security incident response across complex environments.
Why should incident response planning include supply chain-related incidents?
Modern threat actors often exploit vulnerabilities in third-party vendors to gain access to target organizations. That’s why effective incident response planning must extend beyond internal systems to account for supply chain-related incidents. Including third-party scenarios in your cyber security incident response plan helps organizations quickly assess vendor impact, coordinate outreach, and prevent the spread of risk across the digital ecosystem. As supply chain attacks grow more frequent and sophisticated, this proactive approach is essential to maintaining resilience.
What's an incident response procedure?
An incident response procedure is the structured set of actions an organization follows when a security event occurs. These procedures are designed to guide security teams—from the initial detection of an incident to its containment, eradication, and recovery. A well-defined incident response procedure ensures that actions are repeatable, efficient, and compliant with policy. It’s the tactical playbook that supports the broader strategy outlined in the organization’s incident response plan.
What are the steps of incident response?
The six traditional incident response steps are preparation, identification, containment, eradication, recovery, and lessons learned. These steps help security teams detect cyber incidents, limit damage, restore affected systems, and improve their response to future threats.
- Preparation: Establish incident response policies, assign responsibilities, develop response playbooks, and train employees.
- Identification: Detect and investigate suspicious activity to determine whether a security incident has occurred, what systems are affected, and how severe the incident is.
- Containment: Isolate compromised systems, restrict unauthorized access, and prevent the incident from spreading while preserving relevant evidence.
- Eradication: Remove malware, eliminate unauthorized access, remediate exploited vulnerabilities, and address the root cause of the incident.
- Recovery: Restore affected systems and business operations, validate security controls, and monitor for signs of reinfection or continued compromise.
- Lessons learned: Review the incident timeline, evaluate response effectiveness, document findings, and update security controls and response procedures.
These traditional incident response steps are commonly used to structure operational playbooks. The newer NIST SP 800-61 Rev. 3 guidance aligns incident response with the NIST Cybersecurity Framework 2.0, emphasizing Detect, Respond, and Recover, supported by ongoing preparation, governance, and improvement.
An effective incident response plan documents how an organization will carry out these activities, including who is responsible, when incidents should be escalated, and how teams will coordinate their response.
What's the main objective of an incident response plan?
The main goal of an incident response plan is to enable a swift, coordinated, and effective response to cyber incidents. The plan ensures that teams can mitigate the impact of an incident—minimizing downtime, data loss, and reputational harm. It also supports compliance, improves communication across stakeholders, and helps organizations recover operations with confidence. Ultimately, incident response planning reinforces resilience in the face of evolving cyber threats.
Strengthen your cyber resilience with Bitsight
An effective incident response plan depends on timely, actionable intelligence to identify threats, assess their impact, and prioritize remediation. Bitsight connects external attack surface visibility, threat intelligence, and business context to help organizations manage cyber risk across their extended attack surface.
By continuously monitoring exposures and measuring security posture improvements, Bitsight helps organizations apply lessons learned, strengthen incident preparedness, and communicate cyber risk to business leaders.
Strengthen your incident response readiness with Bitsight. Discover how Bitsight's cyber risk intelligence solutions can help you prioritize threats, reduce exposure, and improve cyber resilience.
