Incident Response Plan for a Cyber Attack: 7 Steps and a Free Template
An incident response plan is a written playbook that tells your team exactly what to do during a cyber attack: who to call, how to contain the damage, how to recover and who must be notified. A good plan fits on a few pages, names real people and gets tested before you need it. This guide walks through the seven steps to build an incident response plan for a cyber attack, what Oklahoma law expects and where to get a free template you can fill in today.
Get Protected
Endpoint Detectives runs 24/7 managed detection and response (MDR) on CrowdStrike for $150 per workstation per year, billed annually up front. No hidden fees.
What Is an Incident Response Plan?
An incident response plan is a short document that turns panic into a checklist. It lists the people, phone numbers, decisions and steps your business follows from the moment an attack is spotted until operations are back to normal.
The plan is not an IT manual. It is written for owners, office managers and outside partners as much as for technical staff. When ransomware locks a file server at 6 a.m., nobody should be searching email for the cyber insurance policy number.
Many organizations still go without one. The ABA 2023 Cybersecurity TechReport (2023 Legal Technology Survey) found only 34% of respondents said their firm had an incident response plan, down from 42% the year before. Law firms are not unusual here. Small businesses in every industry tend to put the plan off until after their first scare.
Why Does Every Business Need a Plan for a Cyber Attack?
Every business needs a plan because attacks move faster than people can improvise. The CrowdStrike 2026 Global Threat Report found average eCrime breakout time fell to 29 minutes, and the fastest observed breakout was 27 seconds. Breakout time is how long an attacker needs to spread from the first machine to others.
Slow response is expensive. The IBM Cost of a Data Breach Report 2026 found the mean time to identify and contain a breach rose to 247 days, and the IBM Cost of a Data Breach Report 2026 found the global average cost of a data breach is $4.99 million. Ransomware is the most common worst case. The Verizon 2026 DBIR found ransomware was present in 48% of breaches.
A written plan cuts the time lost to confusion in the first hour. It also gives your insurer, your lawyer and your customers proof that you took security seriously.
What Does Oklahoma Law Expect?
Oklahoma law treats an incident response plan as part of reasonable security. SB 626 defines reasonable safeguards as policies and practices that protect personal information appropriate to the size of the entity, including risk assessments, technical and physical layered defenses, employee training and an incident response plan.
The law also sets notice rules. Under Oklahoma SB 626, effective January 1, 2026, an entity must notify the Oklahoma Attorney General no later than 60 days after notifying affected residents when a breach affects 500 or more Oklahoma residents.
The reward for being prepared is real. Under Oklahoma SB 626, an entity that used reasonable safeguards and gave the required notice faces no civil penalty and has an affirmative defense in a civil action. For a small business in Oklahoma City or Tulsa, a written and tested plan is one of the simplest ways to show those safeguards exist.
What Framework Should Your Plan Follow?
Use the current federal guidance as your outline, then keep the plan simple enough for your team to follow. NIST SP 800-61 Revision 3, finalized April 3, 2025, organizes incident response recommendations around the six CSF 2.0 functions and supersedes Revision 2.
Those six functions are Govern, Identify, Protect, Detect, Respond and Recover. You do not need to adopt the whole framework to use it. Think of it this way:
| Function | What it means for your plan |
|---|---|
| Govern | Who owns the plan and who can make decisions |
| Identify | What systems and data matter most |
| Protect | The defenses that lower the odds of an incident |
| Detect | How you find out something is wrong |
| Respond | The steps to contain and remove the threat |
| Recover | How you restore systems and learn from it |
Our overview of the NIST CSF 2.0 explains the functions in more detail.
How Do You Write an Incident Response Plan in 7 Steps?
Write the plan in seven steps, starting with people and ending with practice. Each step below maps to a section of our free template.
Step 1: Name the Response Team
List who leads, who handles technical work, who talks to staff and customers and who calls the lawyer and insurer. Include a backup for each role and both work and personal phone numbers. Add your outside IT provider, your security provider, your cyber insurer and outside counsel.
Step 2: List Critical Systems and Data
Write down the systems your business cannot run without, such as email, accounting, the practice or job management system and the file server. Note where sensitive data lives, such as customer records, payroll and health or financial information.
Step 3: Define What Counts as an Incident
Give your team clear examples: a ransom note, a locked account, an unexpected wire transfer request, a laptop that will not stop running at full speed or a warning from your security provider. Add a simple severity scale so a phishing email is not handled like a server outage. A three level scale works for most small offices: low for a single suspicious email, medium for one compromised account or device, and high for anything that stops the business or exposes customer data.
Step 4: Write the First Hour Checklist
This is the most important page. It should say: do not turn off the affected computer, unplug it from the network, call the response lead, call your security provider, write down what you saw and when. It should also say what not to do, such as paying a ransom or emailing the attacker.
Step 5: Plan Containment and Recovery
Describe how you isolate machines, reset passwords, restore from backups and decide when systems are safe to use. Confirm your backups are offline or immutable and that someone has tested a restore in the last few months.
Step 6: Set Up Notification Steps
List who must be told, in what order and by whom. That includes your insurer, your lawyer, affected customers and, when the breach is large enough, the Oklahoma Attorney General. Keep draft notice language ready so you are not writing it under pressure.
Step 7: Test and Update the Plan
Run a tabletop exercise at least once a year and after any major change in staff or systems. CISA publishes free Cybersecurity Tabletop Exercise Packages (CTEPs) that organizations can use to plan and run their own exercises. Afterward, fix the gaps the exercise exposed and date the new version.
Get Protected
A plan works best when someone is already watching. Endpoint Detectives analysts can respond to a confirmed threat in as little as 15 minutes.
How Does MDR Fit Into Your Incident Response Plan?
Managed detection and response fills the Detect and Respond parts of the plan with people who do this every day. Instead of hoping an employee notices something odd, a 24/7 security operations center (SOC) watches every workstation and acts on real threats.
Every Endpoint Detectives subscription includes the CrowdStrike EDR license, endpoint monitoring, network monitoring, cloud monitoring, vulnerability scanning, SIEM log aggregation, a 24/7 SOC and remote incident response. EDR is endpoint detection and response software, and SIEM is security information and event management, which keeps the logs you need to reconstruct what happened.
In your plan, list your MDR provider as the first technical call. Endpoint Detectives customers deploy the CrowdStrike agent themselves with an easy-to-follow guide, so coverage can be in place before you finish writing the rest of the plan. Read our incident response services page to see what happens during a live incident.
What Mistakes Should You Avoid?
The most common mistake is writing a plan nobody can find during an attack. Keep a printed copy and an offline copy, because your email and file server may be the systems that are down.
Other mistakes show up again and again:
- Generic contacts. "Call IT" is not a plan. Use names and cell numbers.
- No decision owner. Someone must have the authority to shut down systems or call in outside help.
- Untested backups. A backup that has never been restored is a hope, not a control.
- Skipping the lawyer. Notice rules and privilege questions come up fast.
- Never practicing. A plan that has not been tested will fail in small, painful ways.
Start by checking your gaps with our cybersecurity risk assessment template, then fill in the incident response plan template below.
FAQ
What should an incident response plan include?
It should include the response team and contacts, critical systems, a definition of an incident, a first hour checklist, containment and recovery steps, notification steps and a testing schedule.
What are the steps of incident response?
Most plans follow the CSF 2.0 functions used in NIST SP 800-61 Revision 3: Govern, Identify, Protect, Detect, Respond and Recover.
How often should an incident response plan be tested?
Test it with a tabletop exercise at least once a year and after any big change in people or systems.
Is there a free incident response plan template?
Yes. Our free template turns the seven steps in this guide into fill-in tables you can print and keep offline.
Conclusion
An incident response plan is a few pages that decide how bad a cyber attack gets. Name your team, list your critical systems, write the first hour checklist, plan recovery and notice, then test it. For Oklahoma businesses, a written plan is also part of the reasonable safeguards SB 626 describes.
This article is general information, not legal advice. Talk with your attorney about notice obligations for your business.
Get the Free Incident Response Plan Template
Our free template turns the seven steps into fill-in tables you can print and keep offline. Enter your email and the download starts right away. Pair it with the risk assessment to find gaps first.
Want to find gaps first? Get the risk assessment template.
Related Guides
Get Protected
Endpoint Detectives delivers 24/7 MDR on CrowdStrike for $150 per workstation per year, billed annually up front. No hidden fees. Talk to us about putting a team behind your plan.
Born in Oklahoma. Hunting threats everywhere. Real humans. Real response. No corporate runaround. No hidden fees. No mercy for threats.
Last updated: October 28, 2026