Cyber Incident Response Plan & Toolkit
When something goes wrong, know exactly what to do next.
A practical, ready-to-use incident response system for UK SMEs - a plan, a workbook, five playbooks, a communication pack and an emergency card.
Current version: 1.6 · Updated 26 August 2026
- ✓ Editable DOCX & XLSX files
- ✓ Instant download
- ✓ One-off payment
- ✓ Future updates included
- Something has been hacked.
- An employee's account has been compromised.
- You've discovered ransomware.
- A customer has asked whether their data was exposed.
What do you actually do first?
The toolkit gives your business a structured process to follow, rather than leaving you searching for answers while an incident is happening.
Overview
The Cyber Incident Response Plan & Toolkit gives your business a clear, documented process to follow when something goes wrong - a phishing compromise, ransomware, a lost device or a data exposure.
Instead of improvising under pressure, your team works through a defined sequence: identify the incident, contain it, assess its severity, investigate, recover, communicate appropriately, and record what happened for later review.
It's written for businesses without a dedicated security or incident response function, so the language is plain and the steps are actionable rather than theoretical.
What's included
Incident Response Plan
The core operational plan covering identification, containment, investigation, eradication, recovery and review.
Incident Response Workbook
A structured Excel workbook for incident logging, evidence, decisions, actions, communications and breach assessment.
5 Practical Playbooks
Phishing / compromised account, ransomware / malware, suspected personal-data breach, business email compromise / payment fraud, and lost / stolen device.
Communication Pack
Ready-to-adapt employee, management, customer, supplier and recovery communications.
Emergency Card
A condensed first-response reference you can print and keep accessible.
- Editable Cyber Incident Response Plan (Word)
- Incident Response Workbook (Excel)
- Severity assessment
- Incident, action, evidence and decision tracking
- Five practical incident playbooks
- Communication Pack
- Personal-data breach assessment material
- Specialist escalation guidance
- Worked Microsoft 365 compromise example
- Emergency response card
- Future product updates included
Formats: DOCX · XLSX · PDF
Buy once. Keep it current.
Your purchase includes future updates to this document at no additional cost. We may update documents when we identify errors, improve their usefulness, or when relevant guidance or requirements change.
Document preview
Real pages from the actual document - the full toolkit is included after purchase.
More than a template
This isn't simply a Word template. It's designed as a practical response system: Plan → Assess → Contain → Investigate → Recover → Review.
- 1
The plan
Tells you what to do at each stage of an incident.
- 2
The workbook
Records what happened - decisions, evidence, actions and communications.
- 3
The playbooks
Help with five of the most common incident scenarios.
- 4
The Communication Pack
Helps you know what to say to employees, customers, suppliers and management.
- 5
The Emergency Card
Gives you the first steps when time matters.
Good to know
- Written around current public UK guidance (NCSC incident-management guidance, ICO personal-data breach guidance).
- A practical business template, not legal, regulatory, forensic or insurance advice.
- Not a guarantee of compliance or certification.
- Fully editable - adapt it to how your business actually operates.
- Designed for small and medium UK businesses without a dedicated security team.
- Not a replacement for specialist incident response, forensic investigation or legal advice when you need it.
Version history
- Initial public release of the complete toolkit: incident response plan, workbook, five playbooks, Communication Pack, personal-data breach assessment material, specialist escalation guidance, worked Microsoft 365 example and emergency card.
Who is this for?
Small and medium UK businesses without a dedicated security or incident-response team who need a documented, workable response process before an incident happens - not during one.
FAQ
What is an incident response plan?+−
A written process that sets out what your business does when a cyber incident happens - who's in charge, how you contain and investigate it, and how you communicate and report on it - so your team is following a plan rather than improvising.
Does a small business need a cyber incident response plan?+−
Any business holding customer data, using email, or depending on IT systems can be affected by a cyber incident. Without a documented process, the first hour of a real incident is often spent working out who's in charge and what to do, rather than acting.
Is this suitable for UK businesses?+−
Yes. It's written in UK English and structured around current public UK guidance, including NCSC incident-management guidance and ICO personal-data breach guidance.
Is the document editable?+−
Yes. The plan is delivered as a fully editable Word document and the workbook as an editable Excel file, so you can add your own branding, contacts and wording.
What file formats are included?+−
You'll receive the plan as DOCX and PDF, and the workbook as an XLSX spreadsheet.
Does it include a ransomware response plan?+−
Yes - one of the five included playbooks covers ransomware and malware specifically, alongside the general containment and recovery guidance in the main plan.
Does it include a GDPR/data breach assessment?+−
Yes. The toolkit includes personal-data breach assessment material to help you work through whether a breach may need to be notified - it does not replace the ICO's own notification process or legal advice.
Can I customise it for my business?+−
Yes. It's designed to be adapted - add your own roles, contacts, systems and branding throughout the plan and workbook.
Are future updates included?+−
Yes. Your purchase includes future updates to this product at no additional cost - see 'Buy once. Keep it current.' below.
Is this legal advice?+−
No. This is a practical business template, not legal, regulatory, forensic or insurance advice, and it doesn't guarantee compliance or certification. Adapt it to your circumstances and check current official guidance.
How do I download it after purchase?+−
Your files are available to download immediately after checkout, with a download link on your order confirmation page and in your account - no waiting and nothing physical is posted.