Security Incident Management Pack — Guide
- Version 1.3
- Updated
- 11 documents
- Word, Excel
Security Incident Management Pack
The first serious incident is the wrong time to decide who is in charge, how bad it is, and whether the regulator must hear about it by tomorrow morning. Most teams have a plan nobody has opened, no agreed severity levels, and three legal clocks they only learn about once they are running. This pack gives a small team a working incident capability before it is needed.
Is this for you?
This pack is for you if:
- nobody could say who decides to take a system offline at 2 a.m.;
- you could not tell, within four hours, whether an incident must be reported;
- your last incident ended without a written review or any follow-up.
Three clocks start at once
When an incident is declared, the reporting clocks start. The pack screens every incident against all three within four hours of declaration (IM-06), whether or not a report follows.
| Law | Who it binds | First deadline | Then |
|---|---|---|---|
| NIS2 Article 23 | Essential and important entities, for a significant incident | Early warning within 24 hours | Notification within 72 hours; final report within one month of it |
| GDPR Articles 33–34 | Every controller, for a personal data breach | The authority without undue delay and, where feasible, within 72 hours of awareness, unless it is unlikely to result in a risk | The people affected without undue delay, if the risk is high |
| DORA Article 19 | Financial entities, for a major ICT-related incident | Initial notification within 4 hours of classifying it as major, and within 24 hours of awareness | Intermediate report within 72 hours; final report within one month |
If you are in the United States, or serve people who are, five more questions follow the three: HIPAA, the SEC’s Form 8-K Item 1.05, New York’s financial services rule, State breach laws and the FTC’s rules. Their clocks start elsewhere. HIPAA and State laws run from discovery, the first day anyone knew, which can be earlier than declaration; the SEC’s four business days run from the decision that an incident is material; New York’s 72 hours from determining that an incident has occurred. The pack records the discovery time (IM-13) and keeps the US rows beside the EU ones. It is not legal advice: ask counsel which duties bind you.
Severity is separate. The pack’s four levels set how fast you respond and who is told, judged on the worst thing the incident has done or could do. When in doubt, choose the higher level.
How it runs in practice
Take a distributor with 900 staff. At 07:50 its monitoring provider alerts on encryption activity at one warehouse. Triage starts 15 minutes later, and the incident manager declares Severity 1 at 08:25. The site is cut off at 09:10, the crisis team meets at 09:20 and the board chair hears at 12:20. By 13:50, six hours after the alert, 14 office PCs are contained and ordering was never touched. The NIS2 early warning goes at 15:40, the notification two days later and the final report in September, each within its deadline. The review four working days after closure produces five actions with owners, including removing local administrator rights from every office PC.
Start with these three
- Incident Response Plan: who leads, who decides, and the phases from report to review.
- Incident Classification, Severity & Escalation Matrix: the four severity levels, who to tell and every reporting clock.
- Incident Triage & First-Hour Assessment Procedure: from a report to a declared incident with a severity, in the first hour.
Your first month
| When | What to do | You’re done when |
|---|---|---|
| Week 1 | Name the incident manager, the executive incident lead and their deputies. | Management has approved the plan’s roles. |
| Week 2 | Set the severity thresholds and fill in the contact directory, suppliers included. | Every number has been called once. |
| Week 3 | Work out which laws apply to you, and where each report goes. | The matrix names each authority. |
| Week 4 | Run the readiness checklist and a one-hour walk-through of a ransomware case. | Failed items have owners and dates. |
Four numbers to report
Report these to executive management each quarter.
| Number | Target |
|---|---|
| Significant incidents, and hours from detection to containment | Each contained within 24 hours |
| Reports to authorities and individuals made on time | All |
| Post-incident review actions overdue | None more than 30 days overdue |
| Months since the plan was last exercised | 12 or fewer |
The first is the incident measure in a board report. Every Severity 1 and 2 incident has a review within ten working days of closure, and the risks it touches are reassessed in the risk register.
Everything in the pack
- Word
Security Incident Management Policy
The thirteen rules management approves
- Word
Incident Response Plan
Roles, decisions and phases
- Excel
Incident Classification, Severity & Escalation Matrix
Severity, categories and the reporting clocks, EU and US
- Word
Incident Triage & First-Hour Assessment Procedure
From report to declared incident
- Word
Ransomware Response Playbook
Contain, recover, and the extortion decision
- Word
Business Email Compromise Response Playbook
Stop the payment, secure the mailbox
- Word
Personal Data Breach Response Playbook
Assess the risk; notify or record
- Excel
Incident Case & Action Log
Every case, report and action, with deadlines
- Word
Incident Communications Template Set
Twelve approved messages, from staff to regulator
- Word
Post-Incident Review Template
What happened, why, and what changes
- Excel
Incident Response Readiness Checklist
Are we ready, area by area
No document matches those words.
Adapting it
- Small organisation: one person can hold several roles, but the incident manager and the executive incident lead are always two different people, each with a deputy; the executive incident lead is usually the managing director.
- Regulated entity: a financial entity follows DORA’s classification and its four-hour initial notification instead of NIS2’s early warning. Everyone keeps GDPR’s clocks.
- US organisation: answer the US questions too and record the discovery time. The pack names, without working through, CIRCIA (its final rule had not been published on 18 October 2026) and DFARS.
- IT run by an outside provider: most of the hands-on response is theirs. Check that the contract makes them report an incident within 24 hours and join your response, and put their out-of-hours line in the contact directory.
Where it maps
- ISO/IEC 27001:2022: Annex A 5.24 to 5.28 and 6.8.
- NIST CSF 2.0: RS.MA-01 and DE.AE-08.
- NIS2: Article 21(2)(b) and Article 23.
- GDPR: Articles 33 and 34.
- DORA: Articles 17 to 19.
- HIPAA: 45 CFR 164.402 to 164.412.
- SEC: Form 8-K Item 1.05.
- NYDFS: 23 NYCRR 500.17.