Last Updated: 23 October 2026
Quick Summary
An incident response plan is a written set of steps telling your team exactly what to do when systems are breached, data is lost, or files are locked. It should cover six core components: preparation, identification, containment, eradication, recovery and lessons learned. UK firms must also report certain personal data breaches to the ICO without undue delay, and where feasible within 72 hours.
- Name one person to own the plan, because without an owner it rots.
- List two names per role, since people are on leave, on trains, or asleep.
- Keep a printed contact sheet in a sealed envelope in the office.
- Run a tabletop exercise at least twice a year to find gaps.
- Ask your IT provider in writing what they will do in the first hour of an attack.
Table of Contents
- Why Every UK Firm Needs a Cyber Incident Response Plan
- What to Include in Your Incident Response Plan
- Step-by-Step: How to Build Your Plan
- Using a Cyber Incident Response Plan Template
- A Cyber Incident Response Plan Example in Practice
- Running a Cyber Incident Response Tabletop Exercise
- Cyber Incident Response Plan Testing and Maintenance
- Common Mistakes to Avoid
- Frequently Asked Questions
Why Every UK Firm Needs a Cyber Incident Response Plan
A cybersecurity incident response plan for UK firms is a written set of steps that tells your team exactly what to do when systems are breached, data is lost, or an attacker locks your files. Without one, panic fills the gap that process should occupy.
Most small and mid-sized firms have backups. Few have a plan for the first hour of an attack. That first hour decides how much you lose.
The clock matters for another reason. UK data protection law requires organisations to report certain personal data breaches to the Information Commissioner’s Office without undue delay, and where feasible within 72 hours of becoming aware. You cannot meet that deadline if nobody knows who calls the ICO.
Here is the part most guides miss: a plan is not a document you write once. It is a rehearsed capability. Below, we show you exactly how to build one that holds up under pressure.
What to Include in Your Incident Response Plan
Every plan needs the same six parts, whatever the size of your firm. Skip one and the plan develops a blind spot.
The Six Core Components
- Preparation: roles, contacts, tools and access ready before anything happens
- Identification: how you spot and confirm that an incident is real
- Containment: steps to stop the damage spreading
- Eradication: removing the attacker’s foothold and the malware
- Recovery: restoring systems and data in a controlled order
- Lessons learned: a review that changes the plan for next time
These six stages are the backbone of any incident response plan. The National Cyber Security Centre’s incident response guidance covers the same ground and is a sensible reference point when you draft yours.
Your plan also needs a reporting section. Under UK GDPR, firms must understand their duties to the ICO, including when a breach is notifiable and what the report must contain. Our guide to ICO data breach reporting sets out those duties in plain terms.
Step-by-Step: How to Build Your Plan
Building a plan takes a few focused sessions, not months. Work through these steps in order.
Step 1: Name an owner. One person must own the plan. Without an owner, it rots.
Step 2: List your critical assets. Write down the systems, data and suppliers you cannot run without. Rank them by how badly a day of downtime would hurt.
Step 3: Map the six components to your business. Adapt each stage to your actual systems and people.
Step 4: Build a contact sheet. Include your team, your IT provider, your insurer, your legal adviser and the ICO. Keep a printed copy.
Step 5: Draft the plan. Keep it short. A plan nobody can read at 2am is useless.
If you would rather have expert help from the start, you can contact us to talk through your situation.
Assign Roles and Escalation Paths
Every plan needs named people, not job titles alone. Titles change; names get answers.
- Incident lead: runs the response and makes the call on escalation
- Technical lead: handles containment and recovery
- Comms lead: manages internal updates and any external statements
- Decision maker: authorises spend and regulatory reporting
Add an escalation path for each role. If the incident lead cannot be reached in 15 minutes, who steps in? Write the answer down.
Here are the five steps to work through in order when building your plan.
| Step | What to do |
|---|---|
Step 1 | Name an owner for the plan |
Step 2 | List critical assets and rank by downtime impact |
Step 3 | Map the six components to your business |
Step 4 | Build a contact sheet, keep a printed copy |
Step 5 | Draft the plan and keep it short |
Using a Cyber Incident Response Plan Template
A template saves you the blank-page problem. It gives you the structure so you can focus on the detail that is specific to your firm.
Start from a template, then cut it down. Most templates are written for large enterprises and carry sections a small firm does not need. Keep the six components, the contact sheet and the reporting section. Drop the rest. Refining your documentation in this way ensures that your team remains agile when handling regulatory information requests during the high-pressure environment of a live security breach.
You can download a ready-made data breach response plan template and adapt it to your own systems and team.
What should the template cover? At minimum:
- A one-page summary anyone can follow
- The six response stages with named owners
- A contact and escalation sheet
- Reporting duties and decision points
- A review log so you can track changes
The template is the starting point, not the finished article. Your version must reflect how your business actually runs.
A Cyber Incident Response Plan Example in Practice
Picture a professional services firm on a Tuesday morning. An employee cannot open a shared drive. Files show a ransom note.
Here is how the plan runs:
- The employee calls the incident lead using the number on the printed contact sheet
- The technical lead isolates the affected machines from the network
- The incident lead confirms it is a real incident and starts the log
- The team checks whether personal data was accessed, which triggers the ICO reporting decision
- Recovery begins from clean backups, in priority order
- The firm records what happened and reviews the plan the following week
That sequence is not theory. It is the plan doing its job. For the full data breach response steps to follow, see our step-by-step guide.
Running a Cyber Incident Response Tabletop Exercise
A cyber incident response tabletop exercise is a discussion-based rehearsal where your team talks through a realistic scenario without touching live systems (NCSC launches Cyber Incident Exercising scheme). It is the cheapest way to find the holes in your plan.
Run it like this:
- Pick a scenario, such as ransomware on a finance server
- Give the team the first fact, then feed in new details every ten minutes
- Watch who hesitates, who cannot be reached, and where decisions stall
- Write down every gap you find
- Fix the top three gaps before the next exercise
An hour of honest discussion beats a fifty-page plan nobody has read. Aim to run one at least twice a year.
Cyber Incident Response Plan Testing and Maintenance
A plan that is never tested is a guess. Testing turns it into something your team can trust.
Test in layers:
- Tabletop exercises: discussion-based, low cost, run twice a year
- Contact tests: ring the numbers on the sheet and see who answers
- Backup restore tests: prove you can actually restore, not just that backups exist
- Live simulations: for mature teams, run controlled technical drills
Review the plan after every test and after every real incident. Assign each change to a named person with a date.
For firms without in-house security staff, ongoing monitoring and response capability is the hard part. You can see how a managed security operations centre service fits alongside your own plan. A managed security operations centre can run that for you around the clock, and you can see how a managed security operations centre service fits alongside your own plan.
Common Mistakes to Avoid
The same mistakes sink plans again and again. Here are the ones we see most.
- Writing a plan nobody can find. If it lives on a drive nobody can access during an outage, it does not exist.
- Naming roles without names. Always list a person and a backup.
- Ignoring the reporting clock. Firms forget the ICO deadline until the deadline has passed.
- Never testing. An untested plan hides its own gaps.
- Making it too long. A short plan people use beats a long plan people admire.
- Forgetting suppliers. Your plan must cover third parties who hold your data.
Frequently Asked Questions
What should a cyber incident response plan include?
A complete incident response plan covers six areas: roles and responsibilities, an asset and contact inventory, detection and reporting procedures, containment and eradication steps, communication protocols for staff and regulators, and a recovery and lessons-learned process. It should also name your escalation path and set out when to report to the Information Commissioner’s Office under UK GDPR. Keep it short enough to use under pressure, and store a printed copy offline in case systems are unavailable.
How often should a cyber incident response plan be tested?
Test your plan at least once a year, and after any significant change to your systems, suppliers or team. A tabletop exercise takes a few hours and can be run quarterly for critical teams. Alternate between discussion-based exercises and technical simulations so both decision-making and tooling get checked. Record every gap found and assign an owner and deadline, otherwise testing becomes a box-ticking exercise that gives false confidence.
When should a UK firm report a cyber incident to authorities?
Report a personal data breach to the Information Commissioner’s Office within 72 hours of becoming aware of it, where it is likely to result in a risk to people’s rights and freedoms. Some sectors have additional duties: financial services firms report to the Financial Conduct Authority, and operators of essential services report to their sector regulator. Keep a decision log showing what you knew and when, as this supports both regulatory reporting and any later investigation.
Who should be involved in a cyber incident response team?
Your team needs a named incident lead, an IT or security contact, a communications lead, and someone with authority to make commercial decisions, usually a director. Include your legal adviser and, where relevant, your data protection officer. For SMEs without in-house security staff, an outsourced provider can fill the technical role while your own people handle business decisions. List named deputies for every role and keep contact details accessible offline.
Most UK firms will face a serious cyber incident at some point, and the difference between a bad day and a business-ending one is preparation. TrustedIA provides 24/7 CyberSOS incident response, vCISO advisory and hands-on help building and testing plans, so you get enterprise-grade protection without the cost of full-time security staff. Get started with TrustedIA and turn your incident response plan into a capability your team can rely on.
