Incident Response Plan
Definition
A formal document that defines an organisation's approach to incident handling: roles and responsibilities, escalation paths, communication procedures, legal and regulatory obligations, and authorised response actions. NIST treats the IR plan as the core deliverable of the Preparation phase.
- Phase
- Core deliverable of Preparation
- Contains
- Roles, escalation paths, communication procedures
- Also covers
- Legal obligations, authorised response actions
- Standard
- NIST SP 800-61
Common questions
What makes an incident response plan effective rather than just documentation?+
Regular tabletop exercises and simulated incidents that test whether staff can actually follow the escalation paths and authorised actions under time pressure, not just whether the document exists.
Why must an incident response plan define legal obligations in advance?+
Breach notification deadlines and evidence-handling requirements vary by jurisdiction and sector, and deciding them mid-incident under pressure risks missing statutory deadlines or mishandling evidence in a way that later undermines legal proceedings.
Related terms
- Containment Strategy
- A deliberate decision about how to limit an incident's spread, balancing the need to stop harm immediately against the risk of alerting...
- Eradication
- The phase in which the root cause of an incident is removed from the environment: deleting malware, patching exploited vulnerabilities, revoking compromised...
- Incident Response Lifecycle
- The structured sequence of phases NIST SP 800-61 defines for handling computer security incidents: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity....
- Indicators of Compromise (IoCs)
- Artefacts observed on a network or system that suggest an intrusion or malicious activity has occurred, such as unusual outbound connections, known-malicious...
- Lessons-Learned Meeting
- A structured post-incident review, recommended by NIST within approximately two weeks of incident resolution, that examines what happened, what the response did...