Incident Response Plan (IRP)

An incident response plan (IRP) is the written, approved, and rehearsed playbook an organization follows when a security incident hits: who decides, who acts, who communicates, and in what order — defined before the clock starts running, not improvised while it does. NIST's incident response guidance (SP 800-61) frames response as a lifecycle of preparation, detection and analysis, containment, eradication and recovery, and post-incident learning; the plan is the artifact that makes that lifecycle executable at 2 a.m. by whoever is on call.

How it works

A workable plan is concrete where generic templates are vague. It names an incident commander and deputies, defines severity levels with examples, and maps each incident type to a playbook: what to isolate, whom to call, what evidence to preserve. It lists contacts that cannot be looked up mid-crisis — the bank's fraud desk, outside counsel, the cyber insurer, regulators with notification deadlines such as GDPR's 72 hours. And it plans for degraded conditions: if email is compromised, the response team coordinates somewhere the attacker cannot read.

The most common gap is that plans are malware-shaped while modern incidents are people-shaped. A business email compromise leaves no endpoint to quarantine — the race is recalling a wire transfer within hours. A deepfake voice call or a compromised vendor thread needs verification and finance steps, not forensics alone. Plans that only rehearse ransomware stall exactly when minutes cost the most, a failure mode our guide to incident response for social-engineering attacks examines in detail.

How to defend against it

Keep the plan short enough to use and current enough to trust: review it after every incident and significant hire, and store copies out-of-band. Exercise it — a tabletop exercise twice a year, with executives in the room, surfaces broken assumptions at a cost of two hours rather than two weeks of dwell time. Wire the plan to your human sensors: employees who report fast are the detection layer for social engineering, so a strong reporting culture directly shortens every phase the plan describes.