IR Plan
Definition
The operational document that translates the policy into specific procedures, roles, severity tiers, communication chains, and recovery criteria. Versioned and reviewed at least annually; may reference separate playbooks for specific incident types.
- Purpose
- Translates IR policy into procedures and roles
- Contents
- Severity tiers, communication chains, recovery criteria
- Review cycle
- At least annually
- Related documents
- May reference incident-type-specific playbooks
Common questions
How does the IR plan differ from the IR policy?+
The policy is a brief, rarely-changed statement of management commitment and authority, while the plan is the detailed operational document beneath it, specifying who does what, in what order, and against what criteria during an actual incident.
Why does the plan need annual review rather than being written once and left alone?+
Staffing, systems, and threat patterns change continuously, so a plan reviewed only occasionally tends to list contacts who have left, escalation paths that no longer match the org chart, or recovery steps for systems since replaced, undermining it exactly when it is needed.
Related terms
- Business Continuity Plan (BCP)
- A document that specifies how an organisation keeps critical business functions operating during a significant disruption. The IR plan and BCP must...
- Communication Matrix
- A structured table in an IR plan that maps incident severity tiers to mandatory notification recipients, timelines, and communication channels. It removes...
- Disaster Recovery Plan (DRP)
- A plan focused on restoring IT systems and data after a major failure or destructive event. Often a subset of BCP. The...
- IR Policy
- A management-approved governance statement that commits the organisation to an incident response programme, defines its scope, and grants authority to designated teams....
- Scope Statement
- The formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope...