Incident Response Plan Audit for a Small Team
Check that a plan exists and can be followed.
Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).
Audit our incident response plan. Paste the plan or describe what exists: [IRP_TEXT]. People and roles available: [ROLES]. The last real or practice incident: [LAST_INCIDENT]. Check whether it names an owner, defines what counts as an incident and severity levels, lists contacts that are current, gives first steps for common cases such as a lost laptop or a phishing click, says when to involve outsiders such as insurers and regulators, and describes how to keep records. Read it as a stressed newcomer. Return a table with Section, Gap, Risk (red, amber, green) and Fix, a one-page first-hour checklist, and a tabletop exercise outline. Reporting duties are [VERIFY] for [JURISDICTION] with counsel. Also compare the plan with a realistic scenario, such as a compromised mailbox discovered on a Friday evening, and note which steps would be unclear. Suggest an incident log template and a short review after any incident. Then run a tabletop exercise outline for an hour. Describe the scenario, such as a staff member reporting that they entered their password on a suspicious page, and write ten injects released at intervals, such as an alert from a customer or discovery of forwarding rules. For each inject, give the questions the team should discuss: who decides, what do we check, whom do we tell, what do we preserve and what do we say. Provide a facilitator guide, a note-taker template, and a scoring sheet for the plan's gaps. Add a post-exercise action list with owners and dates, and a one-page incident log template. Suggest how to adapt the exercise for different scenarios and how often to repeat it. Keep everything defensive and use only invented details. Legal reporting duties and insurer requirements are [VERIFY] for [JURISDICTION]. Stay within authorised testing: recommend safe verification steps in a staging environment, and decline to suggest probing third-party systems. Legal and contractual limits on testing are [VERIFY] for [JURISDICTION].
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.