Quick Answer 

A written set of procedures for handling a cyber incident — who does what, in what order, and who gets told. Its value is that the decisions are made calmly in advance rather than at 2am with systems down.

What It Contains

Identification — what counts as an incident, and how staff report one. Reporting has to be easy and blame-free, because the person who clicked the link is your earliest warning.

Roles — named people for technical response, decision-making, and communications. Names and phone numbers, not job titles.

Containment — what to isolate and when. Include what not to do: rebuilding a machine destroys the evidence an investigation needs.

Investigation — establishing what happened and preserving logs before they age out.

Recovery — restoring systems safely, with verification that the threat is actually gone.

Communications — staff, customers, regulators, insurer, and law enforcement, with thresholds for each.

Lessons learned — a review afterwards that changes something.

Call Your Insurer Early

Most cyber policies require notification within 24 to 72 hours of discovery, and many require the insurer's approval before you engage forensic or legal help. Bringing in your own specialists first can affect what's covered. Put the policy number and claims line in the plan itself.

Keep It Where You Can Reach It

A plan stored on the file server is inaccessible during the exact incident it was written for. Keep an offline copy and a printed one, with contact details that don't rely on company email working.

A Plan You've Never Tested Isn't One

Run a tabletop exercise annually — talk through a realistic scenario with the people named in the plan. It surfaces the gaps: the contact who left, the system nobody knew was a dependency, the decision no one is clear they own. Insurers ask for the date of your last exercise.

Example Scenario 

A 120-person professional services firm spotted unusual activity after an employee clicked a phishing link. Because a plan existed, it was reported immediately, affected devices were isolated, and the team followed predefined containment and recovery steps rather than improvising.

How PureStack Builds Your Incident Response Plan

We write a plan that fits how your business actually works, name the roles, run the tabletop exercise, and keep it current as your environment changes.