Compliance guide
Incident Response Policy Template
An incident response policy sets out how your business detects, reports and recovers from a security incident, before one happens, so people aren't improvising under pressure. This guide gives you a free template built around the standard six-phase process, plus a done-for-you option.
Last updated
Key takeaways
- An incident response policy turns a chaotic situation into a known process: who does what, in what order, when something goes wrong.
- It's typically built around six phases: prepare, identify, contain, eradicate, recover, review.
- It sits under your cyber security policy and links to your data breach notification duties.
- Customers and tenders increasingly ask whether you have one, and whether you test it.
What an incident response policy covers
An incident response (IR) policy, sometimes called an incident management policy or an incident response plan, defines what counts as a security incident and how your business responds to one. The aim is speed and consistency: a malware infection, lost laptop, phishing compromise or data breach is stressful, and a clear process prevents costly mistakes.
The six-phase incident response process
Most frameworks (including NIST) follow a version of this lifecycle. Your policy should describe each phase:
- 1
Prepare
Define roles, contacts and tools before an incident; train people and keep an up-to-date contact list.
- 2
Identify
Detect and confirm an incident, and classify how serious it is.
- 3
Contain
Limit the damage, isolate affected systems and stop the spread.
- 4
Eradicate
Remove the cause, malware, compromised accounts or vulnerabilities.
- 5
Recover
Restore systems and data from clean backups and confirm normal operation.
- 6
Review
Run a post-incident review to capture lessons and improve your defences.
What to include: incident response policy template structure
- Purpose and scope, why the policy exists and what counts as an incident.
- Roles and responsibilities, the response team, who leads, and escalation contacts.
- Severity levels, how incidents are classified and prioritised.
- The response process, the six phases above, adapted to your business.
- Reporting, how staff report a suspected incident, fast and blame-free.
- Breach notification, when and how you notify regulators and affected people.
- Communication, who handles internal and external communications.
- Records and review, logging incidents and running post-incident reviews.
- Testing, how often you rehearse the plan (e.g. a tabletop exercise).
Download the editable incident response policy template
Pop your email in and we'll send the incident response policy and plan (Word and PDF), with the six-phase process and a reporting flow ready to adapt.
Free template vs done-for-you document
Happy to adapt the process and contacts yourself? The free template covers it. Want it tailored, with severity levels and notification steps mapped to your obligations? Here's the done-for-you option.
| Free template | Done-for-you document | |
|---|---|---|
| Price | £0 | Fixed fee |
| Effort from you | A few hours editing | A short intake form |
| Roles & contacts mapped | You fill them in | Done for you |
| Breach notification steps | You research them | Matched to your jurisdiction |
| Review-ready PDF | Format it yourself | Supplied, signed-ready |
| If a reviewer pushes back | You fix it | We revise it free |
Prefer your incident response policy done for you?
Tell us about your business and we'll prepare a tailored incident response policy and plan, with severity levels, contacts and notification steps mapped for you.
Requests for the incident response policy are reviewed and prepared manually, we'll follow up by email.