Your incident response plan

Imagine it’s Friday evening. A colleague messages the team: her email has just sent dozens of messages she didn’t write. Who does she call? Who decides whether to warn your partners? Where’s the number for the person who manages your accounts? If nobody knows, the first hour goes on working that out.

An incident response plan answers those questions before you need them. SIIRF’s Building an Incident Response Plan is the full method; this guide gets you started.

What the plan is for

In an incident people are stressed, short of time and short of facts. A plan means the big decisions were made calmly in advance: who’s in charge, who to call and what to do first (SIIRF). Clear roles cut down confusion and panic (Holistic Security).

It doesn’t need to be long. Two or three pages that everyone knows are worth more than a thick document nobody has read (SIIRF). Without one, people feel stuck:

There’s no clear guidance or training on what steps to take, and it feels like something only experts know how to navigate.

A survey respondent, on reporting cyber incidents, New America’s Defending the Defenders, 2025

What goes in it

• What counts as an incident: anything that threatens your information, systems or people, from a clicked phishing link or a lost phone to a hacked account or a colleague being harassed. Agree, too, when a situation becomes an emergency, such as how long someone in the field can be out of contact (SIIRF; Holistic Security).
• How serious it is: four levels, low, medium, high and critical, so the response matches the risk. Anything that puts someone’s safety at risk is critical (SIIRF).
• Who does what: an incident lead who takes charge and keeps the log, a deputy, someone technical, someone for communications, someone for people’s well-being and leadership for the big decisions. Name people, not job titles, and give every role a deputy; in a small team one person may hold several roles (SIIRF).
• How to report: one simple way to tell the incident lead, a backup if that fails and no blame. Ask for the basics: what happened, when, which device or account, and what they’ve done so far (SIIRF).
• The first steps: protect people first, stop the damage spreading and keep the evidence. Don’t delete messages, wipe devices or pay anyone in a rush (SIIRF).
• Talking during a crisis: who tells staff, partners, funders and the people affected, and a backup channel in case email or phones can’t be trusted, such as an encrypted group set up in advance and a phone tree (SIIRF). A group you already use, like an existing Signal group, is easiest, once you’ve checked that no lost, seized or hacked phone or account is in it.
• Contacts: a list that works offline, with a printed copy kept safely: your response team, IT help and outside security experts, a lawyer, your data protection authority, the platforms’ reporting routes, key partners, funders and your bank (SIIRF). Leave off anything that would put a partner at risk if the list were found. Agree outside help before you need it (NDI).
• Playbooks: a one-page checklist for each of your three to five most likely incidents (SIIRF). This handbook has four to start from in Incident Response.
• Legal duties: which data protection laws apply to you, partners and the people you serve. Many require serious breaches of personal data to be reported to a regulator within a short deadline, often 72 hours (SIIRF).
• Records: where the log of what happened is kept, and who keeps it. SIIRF’s Incident Log has a format you can copy.

Keeping records without adding harm

Writing down what happened helps you respond, report and learn, but reading abuse or reliving an attack can hurt. Let a trusted colleague keep the log for the person targeted, take turns if a whole group is under attack, and only continue with their consent (Digital First Aid Kit). Store the records securely, with copies on your own devices as well as online, and encrypted (Digital First Aid Kit). Screenshots should show the web address of the page.

Where to start

Don’t start from a blank page. SIIRF’s Readiness Assessment shows your gaps and produces a simple starter plan you can build on (SIIRF). Fill in the names and contacts first, then add playbooks over time.

If your team doesn’t have the people for some parts, such as technical recovery, many groups bring in outside help (New America). Agree who that will be, and how to reach them, while things are calm.

Practise it

A plan that has never been practised will have gaps. Run a tabletop exercise: walk through a realistic scenario as a team and talk through what each person would do. Keep it to 60 to 90 minutes, and write down every question nobody could answer, because those are your gaps (SIIRF). SIIRF’s Chips Down gives you ready-made scenarios.

Do it every six months, or at least once a year. Consistency matters more than any single exercise:

• people join and leave, and a new colleague hasn’t heard the plan yet
• phone numbers, accounts and tools change, and the plan goes quietly out of date
• people often don’t use what they learned, even after a good session (LevelUp)
• each run finds gaps while they’re still cheap to fix

Role-play can bring back hard memories for people who’ve lived through an attack, so make it optional and check that everyone is comfortable taking part (Holistic Security).

After an incident

Within two weeks, hold a short, blame-free review: what worked, what to change, who will do it and by when. Review the plan after every incident or near miss, and at least once a year (SIIRF). The review is about fixing things, not making anyone relive what happened (Well-being and care).

Where to go next

• SIIRF’s Building an Incident Response Plan: the full method, with an outline checklist.
• Incident Response: the four playbooks.
• Checklists and audits: check the plan still holds.
• Secure messaging: set up your backup channel.