IR Policy
Definition
A management-approved governance statement that commits the organisation to an incident response programme, defines its scope, and grants authority to designated teams. Typically one to three pages; rarely changes unless organisational strategy or legal obligations shift.
- Type
- Management-approved governance statement
- Typical length
- One to three pages
- Function
- Commits organisation to an IR programme, defines scope and authority
- Change frequency
- Rarely, unless strategy or legal obligations shift
Common questions
Why does incident response need a formal policy document at all?+
Without a documented, management-approved mandate, an incident response team can lack the authority to isolate systems, access logs across departments, or direct staff during a crisis, and auditors and regulators typically require this authority to be demonstrable in writing.
What triggers a revision of the IR policy if it rarely changes?+
A merger or divestiture, a new regulatory requirement such as a breach-notification law, or a significant restructuring of the security organisation are the typical events that force a policy update, rather than routine operational experience.
Related terms
- Business Continuity Plan (BCP)
- A document that specifies how an organisation keeps critical business functions operating during a significant disruption. The IR plan and BCP must...
- Communication Matrix
- A structured table in an IR plan that maps incident severity tiers to mandatory notification recipients, timelines, and communication channels. It removes...
- Disaster Recovery Plan (DRP)
- A plan focused on restoring IT systems and data after a major failure or destructive event. Often a subset of BCP. The...
- IR Plan
- The operational document that translates the policy into specific procedures, roles, severity tiers, communication chains, and recovery criteria. Versioned and reviewed at...
- Scope Statement
- The formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope...