Glossary term
Cyber Incident Response Plan
Subject: Technology, Cyber and Data, Cyber Risk and Incident Response
Also known as: CIRP, Cyber Crisis Management
A cyber incident response plan is a documented set of roles, steps and contacts that tells an organisation how to detect, contain, remove and recover from a cyber incident.
Explanation
The plan sets out in advance what people would otherwise improvise under pressure. It names an incident lead and team, defines severity levels, and lists steps by phase: detection and triage, containment, removal of the threat, recovery and review. It holds contact lists for IT, legal, communications, insurers, regulators and external forensic firms, plus decision rights, such as who may shut down a system. Playbooks for common cases, like ransomware or a lost laptop, add detail. Cyber crisis management is the senior layer: when an incident threatens the business, executives and the board take charge of customer messages, regulator contact and strategic decisions. Plans are tested through tabletop exercises and simulations and updated after real events. Exercises show whether people can find the plan at 3 a.m. and whether its decision rights match who actually answers the phone.
Example
A hotel group's plan says a suspected breach goes to the incident lead within an hour and, if guest data is involved, to the crisis group. When malware is found on a reservations server, the team isolates it, calls the forensic firm on retainer, and briefs legal counsel on notice deadlines. A yearly tabletop exercise had rehearsed this very sequence.
Not to be confused with
- Business Continuity Planning (BCP)
- Business continuity planning keeps services running through any disruption; the cyber plan handles the security incident itself, and the two need to fit together.