# Incident response plan template for small IT teams

## Severity levels

- [ ] **SEV1**: business stopped or data at risk (ransomware, outage of a critical system, confirmed breach). All hands, client notified within [30 minutes].
- [ ] **SEV2**: major degradation, workaround exists. Response within [2 hours].
- [ ] **SEV3**: single user or non-critical system. Normal ticket flow.

## Roles

- [ ] Incident lead (decisions, timeline): [name + deputy]
- [ ] Communications (client and internal updates, on a rhythm): [name]
- [ ] Hands-on responders: [names]
- [ ] Out-of-hours escalation path and numbers: [list]

## The first hour (SEV1)

- [ ] Verify it is real; note the time and how it was detected
- [ ] Start the incident log: every action, every time, in one place
- [ ] Contain: isolate affected machines from the network (do not power them off unless data is actively being destroyed; memory is evidence)
- [ ] Disable compromised accounts, revoke their sessions, reset credentials
- [ ] Preserve: no wiping, no reinstalling, no "tidying up" yet
- [ ] Notify: client decision maker, and insurer if cyber cover exists (their approved-vendor terms may constrain what you do next)
- [ ] Check the backups are intact and disconnected from the blast radius before you need them

## Containment and recovery

- [ ] Establish scope: which machines, which accounts, since when
- [ ] Close the entry point before restoring; restoring into an open hole restarts the incident
- [ ] Restore from the last known-clean backup; verify before reconnecting
- [ ] Return systems in order of business priority: [order]
- [ ] Recovery criteria: [malware-free scans, credentials rotated, entry point closed, monitoring in place]

## Afterwards

- [ ] Post-incident review within [1 week]: timeline, what worked, what did not
- [ ] At least one concrete change made and tracked to completion
- [ ] Client report delivered; regulatory notification assessed ([ICO within 72 hours] for personal-data breaches in the UK)

Source: https://www.moorfox.com/templates/incident-response-plan/