Incident Response Plan Completeness Review

Review an incident response plan for completeness, including severity levels, roles, contacts, escalation and testing.

Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).

Review our incident response plan. Plan text: [PLAN_TEXT]. Team and roles: [ROLES]. Systems and data: [SYSTEMS_AND_DATA]. Last test or real incident: [LAST_TEST].

Check for definitions of an incident, severity levels, roles with deputies, contact lists, escalation, evidence preservation, containment steps, communication to staff and customers, regulator and insurer notification, recovery and a review after the event. Rate each section present, partial or missing.

Return a table, the five highest-priority fixes, and a 30-day improvement plan. Legal notification duties must be confirmed [VERIFY] for [JURISDICTION]; this is a defensive review.

Add a worked completeness table with invented ratings. Definition of an incident: present. Severity levels: partial, three levels but no examples. Roles with deputies: missing, no deputy for the lead. Contact list: partial, out of date by a year. Escalation: present. Evidence preservation: missing. Containment steps: partial, only for malware. Communication to staff and customers: partial, templates absent. Regulator and insurer notification: missing. Recovery: present. Post-incident review: missing. Count: present 3, partial 4, missing 4 of 11; completeness score with present as 2 points, partial as 1 and missing as 0 is 6 + 4 = 10 out of 22, 45 percent. Priority fixes: add deputies and a current contact list, write evidence preservation steps, add templates, record notification duties after checking them [VERIFY] with an adviser. Add a 30-day improvement plan with weekly tasks and a rehearsal on day 30. Explain why a plan should be short enough to be used under stress, with one-page checklists for the first hour, and recommend that copies are held offline and by more than one person in case systems are unavailable.

Add a short section on testing the plan: a short call-out drill each quarter, a tabletop exercise each year, and an update after every real incident, with the date of the last version printed on the front page.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

Invented ratings: present 3, partial 4, missing 4 out of 11 sections.
Present: definition, escalation, recovery. Partial: severity levels (no examples), contact list (a year old), containment (malware only), communications (no templates). Missing: deputies, evidence preservation, notification duties, post-incident review.
Score with present = 2, partial = 1, missing = 0: 3 x 2 + 4 x 1 + 0 = 10 out of 22 = 45 percent.
Fixes first: deputies and current contacts; evidence steps; templates; confirm notification duties [VERIFY].
Test: rehearsal at day 30.

• audit