An incident response plan is a short written document that tells your people what to do in the first hours of a cyber attack or data breach: who is in charge, who decides what, how systems are contained and restored, and who must be told and by when. In the UK the hardest deadline is 72 hours, the limit for reporting a personal data breach to the regulator where feasible. Most organisations still do not have a plan. The government's Cyber Security Breaches Survey 2025/2026 found that only 25% of businesses had a formal incident response plan, falling to 21% of micro businesses, while 43% of businesses identified a breach or attack in the previous 12 months.
Why a written plan matters
An incident is the wrong moment to work out who can authorise taking the email server offline or who calls the bank. The National Cyber Security Centre (NCSC) says a well planned and executed response helps to minimise the damage caused by a cyber attack, and that the plan should be linked to disaster recovery, business continuity and crisis management plans.
The survey shows where organisations fall short. After their most disruptive breach, 81% of businesses told their directors, but only 62% kept an internal record and 40% reported it outside the organisation. Even fewer had the building blocks in place beforehand: 39% had assigned roles for incidents, 34% had written guidance on who to notify and 32% had guidance on when to report externally. Larger organisations do better, with formal plans at 57% of medium and 76% of large businesses.
Incident response plan template
A plan for a small or medium organisation can fit on a few pages. Use these sections:
| Section | What to include |
|---|---|
| 1. Scope and definitions | What counts as an incident: ransomware, a compromised mailbox, lost laptop, misdirected email, payment fraud, supplier breach |
| 2. Roles | Incident lead and deputy, IT lead or provider, data protection lead, communications lead, a director with authority to spend and decide |
| 3. Contact sheet | Mobile numbers for all of the above, IT provider, insurer's incident line, bank fraud team, legal adviser. Keep a printed copy, because email may be down |
| 4. Severity levels | Low, medium, high, with examples and who must be called at each level |
| 5. Response steps | Detect, contain, assess, notify, recover, review (see the checklist below) |
| 6. Notification matrix | Who must be told, by whom and the deadline for each |
| 7. Recovery | Location of backups, restore order for critical systems, how to confirm backups are clean |
| 8. Records | Incident log template: time, action, decision, person |
| 9. Review | Lessons learned meeting, plan owner, date of next test |
Incident response checklist
First hour
- Start the log. Record the time of discovery, because the 72-hour clock runs from when you become aware of a personal data breach;
- Contain. Disconnect affected devices from the network but do not wipe them, reset compromised passwords and revoke sessions;
- Escalate. Call the incident lead and the IT provider, and notify your cyber insurer if your policy requires it.
First 24 hours
- Assess. Establish what systems and data are affected and whether personal data was involved;
- Protect money. Warn the bank, check recent payment instructions and confirm any changed supplier bank details by phone;
- Decide on reporting. Assess whether the breach is likely to result in a risk to individuals, and record the reasoning either way.
Within 72 hours
- Report to the regulator if required. Information can be provided in phases if not all of it is available yet;
- Tell individuals if the risk is high. Do this without undue delay;
- Recover. Restore from clean backups and monitor for repeat access.
Who you may need to tell
- The Information Commission. A personal data breach must be reported without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to people's rights and freedoms;
- The people affected. Required where the breach is likely to result in a high risk to them;
- The police. In England and Wales, fraud and cyber crime can be reported to Report Fraud, and suspicious emails can be forwarded to [email protected];
- The Charity Commission. Charities in England and Wales may also need to make a serious incident report to the Commission, even if they have already reported to the police;
- Insurers, banks and clients. Your insurance policy and contracts may set their own notice periods.
Every personal data breach must be documented, whether or not it is reported, with its facts, effects and the remedial action taken. The regulator can ask to see that record.
Worked example
On a Friday at 4pm, a bookkeeper at a 20-person firm notices that client invoices were sent from her mailbox overnight with new bank details. Under the plan, she calls the incident lead, who logs the time and has the IT provider reset the password and revoke all sessions. The mailbox held client names and bank details, so the firm treats this as a personal data breach and records 4pm Friday as the time it became aware. By Saturday it has confirmed which clients received the emails, warned them by phone and followed up in writing, because the risk of payment fraud is likely to be high. It reports to the regulator online the same day, within 72 hours and without waiting for Monday, and adds further details in phases as the investigation continues. Without a plan, the same firm might have waited until Monday to start.
Testing and maintaining the plan
A plan nobody has rehearsed tends to fail on the details: wrong phone numbers, backups no one has restored and a director who is on holiday. Run a short tabletop exercise at least once a year, update the contact sheet whenever staff or suppliers change, and review the plan after every real incident. Link it to your business continuity plan so recovery priorities match.
Sources: Cyber Security Breaches Survey 2025/2026, the NCSC's incident management guidance, Articles 33 and 34 of the UK GDPR and the Charity Commission's guidance on reporting serious incidents. For the wider legal framework, see our guide to UK data privacy regulations.
If you would like your plan and controls reviewed before you need them, our cyber security audit tests both, and our IT risk team can help you write and rehearse the plan.