# Incident response plan: what to write down

Give your team a plan they can find, read and use when something goes wrong.

The Assurance Desk. Published 8 October 2026. Last checked 8 October 2026.

**The short answer.** Write down who to call, who can make decisions, how to keep in touch and where to record the incident. Link the plan to your recovery arrangements and keep the key information somewhere you can still reach if equipment is damaged or stolen ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes) and [NCSC, Small Business Guide: Response & Recovery, Step 1: Prepare for incidents](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery/step-1-prepare-for-incidents), checked 8 October 2026).

## In this series

- [Ransomware: what to do in the first hour](https://theassurancedesk.com/guides/ransomware-what-to-do-in-the-first-hour.md)

## What belongs at the front of the plan?

Put contacts and decision makers at the front of the plan. The National Cyber Security Centre, or NCSC, recommends key contacts, deputies and a clear route to the people allowed to make critical decisions ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes), checked 8 October 2026).

Keep those details easy to find. Lisa Forte’s LinkedIn post gives a useful test for whether the plan is usable under pressure ([Lisa Forte on LinkedIn](https://www.linkedin.com/posts/lisa-forte_your-incident-response-plan-may-end-up-letting-activity-7432767009764917248-FP0W), checked 8 October 2026).

**Contacts and authority to write down**

| Part of the plan | Details to add |
| --- | --- |
| Response lead and deputy | Names, contact details and who can decide if the main person is away. |
| Technical help | IT and incident response contacts, including external support. |
| Business decisions | Who can authorise critical decisions and when senior management becomes involved. |
| Other support | Legal, communications, people team and insurance contacts. |

Source: NCSC, Incident management, Plan: Your cyber incident response processes, https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes (checked 8 October 2026); NCSC, Small Business Guide: Response & Recovery, Step 1: Prepare for incidents, https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery/step-1-prepare-for-incidents (checked 8 October 2026)

> "If your plan can’t be grabbed, scanned, and acted on in seconds it’s not really a useable plan."
> Lisa Forte, LinkedIn post excerpt
> Lisa Forte on LinkedIn, Your Incident Response Plan may end up letting you down. Many organisations still worship the beautiful incident response plan. Glossy. Reviewed to death. Auditor‑approved. ……..And often totally…, https://www.linkedin.com/posts/lisa-forte_your-incident-response-plan-may-end-up-letting-activity-7432767009764917248-FP0W (checked 8 October 2026)
> [View LinkedIn post](https://www.linkedin.com/posts/lisa-forte_your-incident-response-plan-may-end-up-letting-activity-7432767009764917248-FP0W)

## What if email or the office systems are unavailable?

If email or office systems are unavailable, the plan needs another way to communicate. Keep the key information in a safe place you can reach when equipment is stolen or damaged ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes) and [NCSC, Small Business Guide: Response & Recovery, Step 1: Prepare for incidents](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery/step-1-prepare-for-incidents), checked 8 October 2026).

Write down the external help you can call, what its contract covers and when to involve it. Include the reporting duties and insurer requirements that the team needs to check ([NCSC, Small Business Guide: Response & Recovery, Step 1: Prepare for incidents](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery/step-1-prepare-for-incidents) and [NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026).

## What should the response steps cover?

Cover understanding the incident, limiting its spread, removing the threat and recovering. Choose plans for the incidents most likely to affect the business. Link them to arrangements for keeping work going, restoring systems and communicating ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes) and [NCSC, Small Business Guide: Response & Recovery, Step 1: Prepare for incidents](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery/step-1-prepare-for-incidents), checked 8 October 2026).

Keep reviewing tasks and priorities as new findings arrive. Confirm that the threat has been removed before moving into recovery. The people who will restore backups also need to know how and be trained to do it ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes) and [NCSC, Small Business Guide: Response & Recovery, Step 1: Prepare for incidents](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery/step-1-prepare-for-incidents), checked 8 October 2026).

**From understanding the incident to recovery**

- Understand: Work out what has happened. (Contain → Limit the spread)
- Limit the spread: Decide how to contain the incident. (Remove → Remove the threat)
- Remove the threat: Check that the action has worked. (Recover → Recover)
- Recover: Bring systems back through the recovery plan.

Keep findings, tasks and priorities under review throughout. Confirm successful removal of the threat before recovery.

Source: NCSC, Incident management, Plan: Your cyber incident response processes, https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes (checked 8 October 2026)

## What should an incident log include?

An incident log should record discoveries, decisions and actions. The NCSC recommends keeping what was found, when it was found, who decided what and why, and the status of agreed actions ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes) and [NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026).

**An incident log starter**

| Field | Prompt to put in the plan |
| --- | --- |
| Discovery | What did we find? |
| Time | When did we find it? |
| Decision and owner | What did we decide and who made that decision? |
| Reason | Why did we choose that action? |
| Action and status | What was agreed, and is it still open or complete? |

Source: NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities, https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities (checked 8 October 2026)

## How can the team practise using the plan?

The team can practise with the NCSC’s ransomware response exercise. It says to allow 15 to 30 minutes and recommends 3 to 5 people, including someone to lead the session. Participants do not need to be cyber security experts ([NCSC, Exercise: Responding to a ransomware attack](https://www.ncsc.gov.uk/section/exercise-in-a-box/responding-ransomware-attack), checked 8 October 2026).

Bring the plan to the exercise. Use the discussion to check whether people can find the contacts, decision makers and communication arrangements they need ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes), checked 8 October 2026).

**The NCSC’s ransomware exercise gives the team a short way to practise.**

![NCSC ransomware exercise guidance on timing and participants, including a suggested 15 to 30 minute session.](https://theassurancedesk.com/images/editorial/ncsc-ransomware-exercise.png)

Allow 15 to 30 minutes. The NCSC recommends 3 to 5 people, including a person to lead the session, but permits other group sizes. No cyber security expertise is needed. A shared screen may help the discussion.

National Cyber Security Centre. Contains public sector information licensed under the Open Government Licence v3.0. Captured 8 October 2026.
Licence: https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/
Source: NCSC, Exercise: Responding to a ransomware attack, https://www.ncsc.gov.uk/section/exercise-in-a-box/responding-ransomware-attack (checked 8 October 2026); NCSC, Terms & conditions, https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions (checked 8 October 2026); nationalarchives.gov.uk, Open Government Licence, https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ (checked 8 October 2026)

## How do you keep the plan useful?

Keep the plan useful by rechecking the details people will rely on. The NCSC recommends checking important contact details every couple of months or when needed. Keep the support arrangements and route to senior management clear ([NCSC, Small Business Guide: Response & Recovery, Step 1: Prepare for incidents](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery/step-1-prepare-for-incidents), checked 8 October 2026).

Read the plan as the person who has to use it. Can they find the right contact, see who can decide and start the incident record without searching through a long document? The NCSC recommends simple checklists and tracking forms for use in an emergency ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes), checked 8 October 2026).

## What to do

1. List key contacts, deputies and decision makers ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes), checked 8 October 2026).
2. Record external support terms and the point at which to call for help ([NCSC, Small Business Guide: Response & Recovery, Step 1: Prepare for incidents](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery/step-1-prepare-for-incidents), checked 8 October 2026).
3. Keep a safe, accessible copy of the essential information and an alternative way to communicate ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes) and [NCSC, Small Business Guide: Response & Recovery, Step 1: Prepare for incidents](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery/step-1-prepare-for-incidents), checked 8 October 2026).
4. Prepare a simple incident log and link the recovery arrangements ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes) and [NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026).
5. Try the NCSC exercise with the people who would use the plan ([NCSC, Exercise: Responding to a ransomware attack](https://www.ncsc.gov.uk/section/exercise-in-a-box/responding-ransomware-attack), checked 8 October 2026).
6. Set a reminder to recheck important contact details ([NCSC, Small Business Guide: Response & Recovery, Step 1: Prepare for incidents](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery/step-1-prepare-for-incidents), checked 8 October 2026).

## Common questions

### Is an incident response plan just for the IT team?

No. The NCSC contact list includes management, legal, communications, the people team and insurance as well as IT and incident responders. Critical decisions need clear authority ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes), checked 8 October 2026).

### Is this the same as a business continuity plan?

They should link together. The NCSC says the incident plan should connect to business continuity, disaster recovery and communications plans. Keep the response and the arrangements for carrying on working connected ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes), checked 8 October 2026).

### Do we need experts to run a practice exercise?

The NCSC ransomware exercise says participants need no cyber security expertise. It recommends a person to lead the discussion and keep it on track ([NCSC, Exercise: Responding to a ransomware attack](https://www.ncsc.gov.uk/section/exercise-in-a-box/responding-ransomware-attack), checked 8 October 2026).

### Can we use a template as the plan?

Use the prompts as a starting point, then add your actual people, authority, support arrangements and communication routes. Focus the response plans on the incidents your business is most likely to face ([NCSC, Incident management, Plan: Your cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes) and [NCSC, Small Business Guide: Response & Recovery, Step 1: Prepare for incidents](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery/step-1-prepare-for-incidents), checked 8 October 2026).

## Where next

- [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident.md)
- [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach.md)
- [Ransomware: what to do in the first hour](https://theassurancedesk.com/guides/ransomware-what-to-do-in-the-first-hour.md)
- [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md)
- [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md)
- [How much is Cyber Essentials, and what does it ask?](https://theassurancedesk.com/guides/cyber-essentials-cost-and-requirements.md)
- [Keeping personal data secure: what Article 32 requires](https://theassurancedesk.com/guides/keeping-personal-data-secure-article-32.md)

## Sources

- NCSC, Incident management, Plan: Your cyber incident response processes: https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes (checked 8 October 2026)
- NCSC, Small Business Guide: Response & Recovery, Step 1: Prepare for incidents: https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery/step-1-prepare-for-incidents (checked 8 October 2026)
- Lisa Forte on LinkedIn: https://www.linkedin.com/posts/lisa-forte_your-incident-response-plan-may-end-up-letting-activity-7432767009764917248-FP0W (checked 8 October 2026)
- NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities: https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities (checked 8 October 2026)
- NCSC, Exercise: Responding to a ransomware attack: https://www.ncsc.gov.uk/section/exercise-in-a-box/responding-ransomware-attack (checked 8 October 2026)
- NCSC, Terms & conditions: https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions (checked 8 October 2026)
- nationalarchives.gov.uk, Open Government Licence: https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ (checked 8 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.