A usable incident response plan fits on a few pages and answers five things: who can declare an incident, who does what, who to call, how the team talks when email is untrusted, and where an offline copy lives. Detail can sit in appendices. Nobody reads a 60 page PDF at 3 a.m.
Start with who can declare an incident
Most delays happen before anyone says the word "incident". Name the people allowed to declare one and write the plain criteria, such as confirmed unauthorized access, loss of customer data, or ransomware on any production system. Add a rule that anyone can escalate a suspicion without needing to prove it.
Roles, not just names
List the roles you need on the first page: incident lead, technical lead, communications lead, legal contact, and a scribe who keeps the timeline. Put a primary and a backup person against each. People are on holiday or asleep, so a role with one name is a gap.
Contacts you will not have time to look up
Keep a contact table that covers your cyber insurer, outside counsel, any managed security provider, your cloud and identity vendors, and the law enforcement bodies you would report to. CISA's ransomware guide names the FBI, IC3, the U.S. Secret Service and CISA itself as places to report in the United States. Write the phone numbers down rather than linking to a web page that may be unreachable.
A communications plan that survives a compromise
If an attacker may be reading your mail and chat, you need another channel. CISA advises coordinating isolation steps out of band, for example by phone, so attackers are not alerted. Pick that channel in advance and test that everyone can join it.
Decide also who speaks to customers, staff and regulators, and who approves the wording. Draft holding statements now. They are much easier to write when nobody is panicking.
Keep an offline copy
CISA's #StopRansomware guide recommends keeping a hard copy and an offline version of the incident response plan and the communications plan. If your plan lives only in the wiki that was just encrypted, it does not help you. Store a printed copy with the on-call lead and a copy on a device that is not joined to your network.
Plan to exercise it
NIST's 2025 incident response publication, SP 800-61 Rev. 3, frames response as part of everyday cybersecurity risk management, not a separate document you dust off. Put a date in the plan for the next test and for a review after any real incident. A tabletop exercise is the cheapest way to find the missing phone number. See how to run a tabletop exercise.
Where Safeguard fits
Safeguard's asset discovery and compliance evidence automation can help you keep the inventory and records your plan refers to current. The plan itself, and the decisions in it, stay with your people.
Quick check
How long should an incident response plan be?
Short enough that the on-call person reads it before they need it. A few pages for the core plan, with playbooks and contact tables as appendices, is a sound shape.
Do small teams need a written plan?
Yes. A one page plan with roles, contacts and a declaration rule is better than none, and it takes an afternoon to write.
Sources
Last reviewed: 19 October 2026.
