Establish specific definitions and categorizations for security activity, such as what constitutes an event versus an incident and when an incident escalates into a crisis.

Include a severity matrix that prioritizes each incident category, defines when an incident falls into each severity level, and specifies the required response timeline.

Specify the roles and responsibilities of the core incident response team, including decision authorities, senior executives, directors, external legal counsel, digital forensics specialists, public relations, and cyber insurance providers.

Maintain a communications plan that includes internal stakeholders as well as a counsel-approved template specifying an appropriate plan of whom to contact first and when.

Set a recurring training, testing, and maintenance schedule that includes simulated tabletop exercises addressing different attack vectors to keep your team and procedures ready.

Enterprise cloud and hybrid environments present unique challenges for incident response due to their distributed architecture and shared responsibility model. An enterprise cloud template outlines what to include for multitenant security, identity, and API-based threats, and investigating incidents across ephemeral workloads. These templates incorporate cloud-native tools for monitoring and forensics, define procedures for coordinating with cloud service providers, and establish protocols for preserving evidence in dynamic environments. You can explore cloud-specific guidance on the Cloud Security Alliance Cloud Incident Response Framework webpage and review standardized response workflows on CISA’s Cybersecurity Incident and Vulnerability Response Playbooks resource page.

Download the CISA incident response playbook (PDF)

Enterprise IT and computer security incident response templates focus on endpoint protection and network security across on-premises and hybrid infrastructure. These templates summarize comprehensive procedures for handling malware infections, unauthorized access attempts, and data breaches affecting workstations and servers. They include detailed steps for isolating affected systems, collecting forensic evidence from hard drives and memory, and restoring operations while maintaining chain of custody. For foundational guidance, visit NIST’s latest Incident Response Recommendations and Considerations (SP 800-61 Rev. 3) publication webpage.

Download the NIST SP 800-61 Rev. 3 guide (PDF)

Templates designed for cybersecurity managers and security leaders emphasize strategic coordination and communication across multiple teams and stakeholders. These frameworks summarize what to include in escalation matrices for engaging executive leadership, templates for regulatory notifications, and procedures for managing public relations during high-profile incidents. They also provide guidance on resource allocation, vendor management, and post-incident reporting to boards and regulators. For a concise planning checklist, visit CISA’s Incident Response Plan (IRP) Basics resource page.

Download the CISA Incident Response Plan Basics guide (PDF)

Healthcare incident response templates address the unique challenges of protecting patient data while maintaining critical clinical care systems. These templates outline HIPAA breach notification requirements, procedures for handling ransomware attacks on medical devices, and protocols for maintaining patient care during system outages. They include specific guidance for working with electronic health record vendors, coordinating with regional health information exchanges, and managing incidents that could impact patient safety. You can browse sector-specific preparedness toolkits on the HHS 405(d) Health Industry Cybersecurity Practices resource hub.

Download the HHS Health Industry Cybersecurity Practices guide (PDF)

The California Department of Technology (CDT) template provides a comprehensive framework designed for state agencies and public sector organizations managing critical public services. This template emphasizes interagency coordination, public transparency requirements, and procedures for protecting citizen data, including protocols for coordinating with state emergency management offices and maintaining continuity of government services during cyberattacks. You can explore additional public sector security policies on the California Department of Technology Information Security Resources hub.

Download the template (DOC)

The National Institutes of Health (NIH) template addresses the specialized requirements of protecting sensitive research data and maintaining the integrity of scientific and clinical computing environments. The framework summarizes what to document when reporting and responding to incidents, including affected research protocols, clinical trial impacts, containment actions, and corrective measures across research institutes. For policy context and reporting guidelines, visit the NIH Office of Science Policy Incident Reporting webpage.

Download the template (DOCX)

Academic institutions face distinct challenges balancing open research environments with security requirements. The University of Connecticut (UConn) template addresses incidents affecting diverse campus communities including students, faculty, and researchers. It outlines procedures for handling incidents during critical academic periods, protecting student records under FERPA, and coordinating responses across decentralized IT departments. Review the dedicated plan webpage below to see how UConn structures its campus-wide response procedures.

Review the UConn incident response plan template webpage

Customize the template sections to match your organization’s structure and operational workflows. Assign specific individuals—along with designated backups—to each defined role so every stakeholder understands their exact responsibilities during an active security incident.

Populate the contact lists with current primary and out-of-band contact information for all internal and external stakeholders—including security leads, IT leads, executive sponsors, critical vendors, external legal counsel, incident response retainers, and regulatory bodies you might need to notify.

Define your incident classification criteria and escalation thresholds based on your organization’s risk assessment, specifying measurable parameters for what constitutes a minor, major, or critical security incident.

Develop actionable technical runbooks for your most likely threat scenarios—such as ransomware, credential compromise, or cloud data exfiltration—detailing step-by-step procedures for triage, containment, eradication, and recovery.

Schedule regular reviews and updates of the plan, incorporating lessons learned from actual security incidents, infrastructure changes, staffing updates, and simulated tabletop exercises.