Your incident response plan checklist

Who leads Whoever leads on incidents Name

Use it when

you're writing or updating the plan, or practising it with the team.

What goes in it

What counts as an incident, and when it becomes an emergency.
Four levels: low, medium, high and critical. Any risk to people’s safety is critical.
Who does what, with a named deputy for every role.
How to report: one simple way, a backup and no blame.
The first steps: protect people, stop the damage, keep the evidence.
A backup channel, checked for any lost, seized or hacked phone.
Legal duties: serious breaches of personal data often must be reported within 72 hours.

Practise it every six months, or at least once a year, with a tabletop exercise.
Hold a blame-free review within two weeks of an incident.

Take care: Someone else keeps the log for the person targeted, and only with their consent.

Started Done Review again