Security Incident Management Pack — Guide
- Version 1.1
- Updated
- Next review
Security Incident Management Pack
The first serious incident is the wrong time to decide who is in charge, how bad it is, and whether the regulator must hear about it by tomorrow morning. Most teams have a plan nobody has opened, no agreed severity levels, and three legal clocks they only learn about once they are running. This pack gives a small team a working incident capability before it is needed.
Is this for you?
This pack is for you if:
- nobody could say who decides to take a system offline at 2 a.m.;
- you could not tell, within four hours, whether an incident must be reported;
- your last incident ended without a written review or any follow-up.
Three clocks start at once
When an incident is declared, the reporting clocks start. The pack screens every incident against all three within four hours of declaration (IM-06), whether or not a report follows.
| Law | Who it binds | First deadline | Then |
|---|---|---|---|
| NIS2 Article 23 | Essential and important entities, for a significant incident | Early warning within 24 hours | Notification within 72 hours; final report within one month of it |
| GDPR Articles 33–34 | Every controller, for a personal data breach | The authority within 72 hours, unless it is unlikely to result in a risk | The people affected without undue delay, if the risk is high |
| DORA Article 19 | Financial entities, for a major ICT-related incident | Initial notification within 4 hours of classifying it as major, and within 24 hours of awareness | Intermediate report within 72 hours; final report within one month |
Severity is separate. The pack’s four levels set how fast you respond and who is told, judged on the worst thing the incident has done or could do. When in doubt, choose the higher level.
How it runs in practice
Take a distributor with 900 staff. At 07:50 its monitoring provider alerts on encryption activity at one warehouse. Triage starts 15 minutes later, and the incident manager declares Severity 1 at 08:25. The site is cut off at 09:10, the crisis team meets at 09:20 and the board chair hears at 12:20. By 13:50, six hours after the alert, 14 office PCs are contained and ordering was never touched. The NIS2 early warning goes at 15:40, the notification two days later and the final report in September, each within its deadline. The review four working days after closure produces five actions with owners, including removing local administrator rights from every office PC.
Start with these three
- Incident Response Plan: who leads, who decides, and the phases from report to review.
- Incident Classification, Severity & Escalation Matrix: the four severity levels, who to tell and every reporting clock.
- Incident Triage & First-Hour Assessment Procedure: from a report to a declared incident with a severity, in the first hour.
Your first month
| When | What to do | You’re done when |
|---|---|---|
| Week 1 | Name the incident manager, the executive incident lead and their deputies. | Management has approved the plan’s roles. |
| Week 2 | Set the severity thresholds and fill in the contact directory, suppliers included. | Every number has been called once. |
| Week 3 | Work out which laws apply to you, and where each report goes. | The matrix names each authority. |
| Week 4 | Run the readiness checklist and a one-hour walk-through of a ransomware case. | Failed items have owners and dates. |
Four numbers to report
Report these to executive management each quarter.
| Number | Target |
|---|---|
| Significant incidents, and hours from detection to containment | Each contained within 24 hours |
| Reports to authorities and individuals made on time | All |
| Post-incident review actions overdue | None more than 30 days overdue |
| Months since the plan was last exercised | 12 or fewer |
The first is the incident measure in a board report. Every Severity 1 and 2 incident has a review within ten working days of closure, and the risks it touches are reassessed in the risk register.
Everything in the pack
| Document | What it does | Format |
|---|---|---|
| Security Incident Management Policy | The twelve rules management approves | Word |
| Incident Response Plan | Roles, decisions and phases | Word |
| Incident Classification, Severity & Escalation Matrix | Severity, categories and reporting clocks | Excel |
| Incident Triage & First-Hour Assessment Procedure | From report to declared incident | Word |
| Ransomware Response Playbook | Contain, recover, and the extortion decision | Word |
| Business Email Compromise Response Playbook | Stop the payment, secure the mailbox | Word |
| Personal Data Breach Response Playbook | Assess the risk; notify or record | Word |
| Incident Case & Action Log | Every case, report and action, with deadlines | Excel |
| Incident Communications Template Set | Ten approved messages, from staff to regulator | Word |
| Post-Incident Review Template | What happened, why, and what changes | Word |
| Incident Response Readiness Checklist | Are we ready, area by area | Excel |
Adapting it
- Small organisation: one person can hold several roles, but the incident manager and the executive incident lead are always two different people, each with a deputy; the executive incident lead is usually the managing director.
- Regulated entity: a financial entity follows DORA’s classification and its four-hour initial notification instead of NIS2’s early warning. Everyone keeps GDPR’s clocks.
- IT run by an outside provider: most of the hands-on response is theirs. Check that the contract makes them report an incident within 24 hours and join your response, and put their out-of-hours line in the contact directory.
Where it maps
- ISO/IEC 27001:2022: Annex A 5.24 to 5.28 and 6.8.
- NIST CSF 2.0: RS.MA-01 and DE.AE-08.
- NIS2: Article 21(2)(b) and Article 23.
- GDPR: Articles 33 and 34.
- DORA: Articles 17 to 19.
What changed
Each change to this pack's documents since it was published, newest first.Changes across all packs
RD-10 now states DORA's rule for an incident classified as major only after 24 hours: the initial notification is due within 4 hours of that classification (Delegated Regulation (EU) 2025/301, Article 5(2)).
- Security Incident Management Policy 1.1 → 1.2
- Incident Response Plan 1.1 → 1.2
- Incident Triage & First-Hour Assessment Procedure 1.1 → 1.2
- Ransomware Response Playbook 1.1 → 1.2
- Incident Communications Template Set 1.0 → 1.1
RD-10 now states DORA's rule for an incident classified as major only after 24 hours: the initial notification is due within 4 hours of that classification (Delegated Regulation (EU) 2025/301, Article 5(2)); the clock calculator applies it.
The example restore order follows the continuity plan: foundations, then the shortest recovery time first, with the targets from P22 (RR-08).
- Ransomware Response Playbook 1.2 → 1.3
In a small organisation one person can hold several roles, but the incident manager and the executive incident lead are always two different people, each with a deputy.
- Guide 1.0 → 1.1
IM-08 now says the incident manager contains at once with the least disruptive action, and brings in the service owner and specialists before stopping a service people depend on for safety or essential operations. The Policy-tier approver reads executive management, as the Policy Framework Standard sets it.
- Security Incident Management Policy 1.0 → 1.1
Containment is least disruptive first, and the service owner and specialists come in before a service people depend on for safety or essential operations is stopped.
- Incident Response Plan 1.0 → 1.1
Step F4 contains with the least disruptive action and brings in the service owner and specialists before stopping a service people depend on for safety or essential operations.
Containment and site isolation step S3 are least disruptive first, with the service owner and specialists brought in before a service people depend on for safety or essential operations is stopped; the incident manager and executive incident lead are two people even in a small organisation.
- Ransomware Response Playbook 1.0 → 1.1
The first-hour containment step now says to use the least disruptive containment that stops the harm, as IM-08 does.
- Personal Data Breach Response Playbook 1.0 → 1.1
Part L counts every open action past its due date in IMM-03, as the policy defines the measure, not only those more than 30 days late.
- Post-Incident Review Template 1.0 → 1.1
Published. The guide and eleven documents, at 1.0.