Incident response plan template for small IT teams
Quick answer
An incident response plan that fits on one page beats a binder nobody opens. It needs five things: severity definitions everyone shares, named roles (who leads, who communicates, who fixes), a first-hour sequence (verify, contain, preserve, notify), recovery criteria (what must be true before systems return), and a review that changes something afterwards. Download the template and fill the brackets while nothing is on fire.
Severity levels
- SEV1: business stopped or data at risk (ransomware, outage of a critical system, confirmed breach). All hands, client notified within [30 minutes].
- SEV2: major degradation, workaround exists. Response within [2 hours].
- SEV3: single user or non-critical system. Normal ticket flow.
Roles
- Incident lead (decisions, timeline): [name + deputy]
- Communications (client and internal updates, on a rhythm): [name]
- Hands-on responders: [names]
- Out-of-hours escalation path and numbers: [list]
The first hour (SEV1)
- Verify it is real; note the time and how it was detected
- Start the incident log: every action, every time, in one place
- Contain: isolate affected machines from the network (do not power them off unless data is actively being destroyed; memory is evidence)
- Disable compromised accounts, revoke their sessions, reset credentials
- Preserve: no wiping, no reinstalling, no "tidying up" yet
- Notify: client decision maker, and insurer if cyber cover exists (their approved-vendor terms may constrain what you do next)
- Check the backups are intact and disconnected from the blast radius before you need them
Containment and recovery
- Establish scope: which machines, which accounts, since when
- Close the entry point before restoring; restoring into an open hole restarts the incident
- Restore from the last known-clean backup; verify before reconnecting
- Return systems in order of business priority: [order]
- Recovery criteria: [malware-free scans, credentials rotated, entry point closed, monitoring in place]
Afterwards
- Post-incident review within [1 week]: timeline, what worked, what did not
- At least one concrete change made and tracked to completion
- Client report delivered; regulatory notification assessed ([ICO within 72 hours] for personal-data breaches in the UK)
The incident log wants evidence.
Moorfox keeps every machine's logs on the control plane, readable even when the machine is offline or isolated, which during an incident is exactly when you need to know what it was doing.