Security Incident Response Plan Outline
Prepare for a suspected compromise at your organisation.
Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).
Outline a security incident response plan for my organisation. Size and type of organisation: [ORGANISATION]. Systems and data that matter most: [CRITICAL_ASSETS]. Existing contacts (legal, IT, management, insurer): [CONTACTS]. Provide phases: preparation, detection and triage, containment, eradication, recovery, and lessons learned. For each phase list actions, roles, decision points, and evidence handling basics such as preserving logs and keeping a timeline. Include a triage questionnaire for the first 15 minutes, contact lists to maintain, and notification obligations to be confirmed with counsel in [JURISDICTION] ([VERIFY]) for personal data breaches. Keep to defensive response: do not include instructions for attacking or retaliating against anyone. Add a table of five scenarios (phishing, lost laptop, ransomware, leaked credentials, account takeover) with first actions. Recommend when to bring in external specialists. Add a section on evidence preservation in defensive terms: keep logs and disk images, record who touched what and when, and do not wipe systems before consulting the response lead. Provide a first-hour checklist of ten items for a small organisation, and a template for a daily status update to leadership during a prolonged incident. Add an incident severity scale of four levels with objective criteria (number of accounts affected, type of data, business function lost) and the response each level triggers. Provide a worked scenario for a small organisation: a staff member reports that a shared mailbox sent invoices with changed bank details. Walk through the first hour minute by minute, showing who is called, what is preserved, what is contained, and what is deliberately not touched. Add a decision log template with time, decision, reason and person, and a communication plan covering staff, customers, the insurer, and regulators, with a reminder that notification duties must be confirmed with counsel. End with a post-incident review agenda and a tabletop schedule of two exercises per year.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.
See an example result (fictional data)
Phases: preparation, detection and triage, containment, eradication, recovery, lessons learned. First 15 minutes triage: What was seen? Which systems? Is data involved? Is it ongoing? First-hour checklist (small organisation): isolate the affected device, preserve logs, note times, inform the response lead, list affected accounts, change credentials from a clean device, tell management. Scenario table Phishing click: reset password, review mailbox rules. Lost laptop: remote lock, confirm encryption. Notification obligations: confirm with counsel for [JURISDICTION] [VERIFY]. Call external specialists if data was exfiltrated or systems are encrypted.
Illustrative only, made-up data. Your results will differ and must be reviewed.