Incident Response Readiness Checklist

Confirms contacts, tooling access, log availability, retainers and delegated authority are in place before an incident occurs.

Available soon

Format: Excel
Size: 59 KB
Length: 9 sheets
Version: 1.0
Updated: 28 Sep 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.029 Sep 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Check at least once a year, after every Severity 1 incident and after a change of people, suppliers or systems that the plan relies on (IM-12). Do it with the Incident Response Plan and the contact list open.
2	For each item, look at the evidence, not at what people say: open the contact list, test the out-of-hours number, sign in with the emergency account. Record where the evidence is in 'Evidence reference'.
3	Enter the owner (the person who keeps the item true), the date you checked, and the result from the list: Pass, Fail, or N/A. A Fail or N/A needs a reason. The Check column prompts for anything missing.
4	Items marked Critical are the ones without which the first hours of a serious incident would fail. A Fail on any of them makes the status Not ready: fix it first. Put every Fail on an action list with an owner and a due date — the Incident Case & Action Log's Actions sheet, or your own tracker.
5	Read the Summary: counts by area and overall, and the readiness status. Then complete the sign-off: the person who checked, the Head of Information Security, and the executive incident lead who accepts the result.
6	Add items of your own on the blank rows at the foot of the checklist, with an ID in the same form (RC-area-number) and an area from the list.
7	To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow column; the items stay.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State; not a financial entity, so DORA's reporting duties do not apply. Its self-check as at 2026-09-30, the quarter of its ransomware incident (INC-2026-014). The plan was exercised on 2026-03-18. One item fails: the ransomware playbook still lacks the site isolation steps the review asked for (PIA-04, overdue). DORA's item is N/A.

Tailoring — small organisation: keep every Critical item; the others can be met simply (one contact list, one playbook for everything but ransomware and payment fraud). N/A is a reason, not a way to skip: say why in the reason column.

Tailoring — regulated financial entity: DORA replaces NIS2's reporting for financial entities. Answer RC-REP-03 instead of RC-REP-01, add items for the classification criteria of Delegated Regulation (EU) 2024/1772 and for reporting major incidents to the management body (DORA Article 17(3)), and test RD-10 to RD-13 in your exercise.

Tailoring — IT run by a managed service provider: most technical items (tooling access, logs, backups, monitoring) are met by the provider. Ask it for the evidence — a restore test report, its log retention, its out-of-hours escalation to your incident manager — and record it here; its word alone is not a Pass.

Checklist

The checks, by area. Yellow columns are yours; the Check column calculates. 12 rules (IM-01 to IM-12) are in the Security Incident Management Policy.

Row	Item ID	Area	Item	Pass when	Rule tested	Critical	Evidence reference	Owner	Date checked	Result	Reason (for Fail or N/A)	Check
EXAMPLE	RC-GOV-01	Governance and plan	The Security Incident Management Policy is approved and in date	Approved by executive management, published to staff, and its review date has not passed.	IM-01 to IM-12	No	Policy approval record and intranet page	Head of Information Security	30 Sep 2026	Pass		OK
EXAMPLE	RC-GOV-02	Governance and plan	The Incident Response Plan is approved, in date and reviewed after the last Severity 1 incident	Approved; review date not passed; reviewed after every Severity 1 incident (IM-12).	IM-12	Yes	Plan reviewed at the INC-2026-014 post-incident review, 27 Aug 2026	Head of Information Security	30 Sep 2026	Pass		OK
EXAMPLE	RC-GOV-03	Governance and plan	The Incident Classification, Severity & Escalation Matrix is tailored and in use	Money thresholds are your own; responders set severity and category from it at declaration.	IM-04	No	Matrix approved; severity and category set in every case in the log	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-GOV-04	Governance and plan	Decision rights are written down and known	Who may isolate, stop a customer-facing service, report to an authority, speak outside, engage outside help and decide on a ransom demand is written and known to the people named (6 decisions).	IM-08	Yes	Incident Response Plan, decision rights table	Chief Operating Officer	30 Sep 2026	Pass		OK
EXAMPLE	RC-GOV-05	Governance and plan	Incidents are reported to executive management every quarter	Incidents by severity, reports made on time and overdue review actions reported each quarter.	IM-12	No	Quarterly summary from the Incident Case & Action Log	Head of Information Security	30 Sep 2026	Pass		OK
EXAMPLE	RC-ROL-01	Roles and contacts	A named incident manager and deputy	Both named, trained in the plan, and one of them reachable at any hour.	IM-03	Yes	Plan roles table; on-call rota	Head of Information Security	30 Sep 2026	Pass		OK
EXAMPLE	RC-ROL-02	Roles and contacts	A named executive incident lead and deputy	Both named and reachable out of hours; the incident manager can reach one of them within 30 minutes.	IM-05	Yes	Out-of-hours numbers tested; INC-2026-014 lead told 15 minutes after declaration	Chief Operating Officer	30 Sep 2026	Pass		OK
EXAMPLE	RC-ROL-03	Roles and contacts	The crisis team can be convened within the hour	Members named; a way to convene them within 60 minutes, including a meeting line that does not depend on our own systems.	IM-05	No	Crisis team list; conference bridge details	Chief Operating Officer	30 Sep 2026	Pass		OK
EXAMPLE	RC-ROL-04	Roles and contacts	The incident contact list is complete, checked and held offline	Responders, executives, board chair, Legal, the Data Protection Officer, insurer, authorities and key suppliers, checked in the last [[3]] months and kept on paper or phones as well as online.	IM-05	Yes	Contact list, checked this quarter	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-ROL-05	Roles and contacts	Responders have the tools and access they need at any hour	Emergency administrator accounts work and are stored safely; the managed IT provider and the security monitoring provider can isolate a device, site or account on the incident manager's word.	IM-08	Yes	Emergency account test; INC-2026-014 site isolated by the managed IT provider	Head of IT	30 Sep 2026	Pass		OK
EXAMPLE	RC-ROL-06	Roles and contacts	A way to talk if email and chat are down or watched	An agreed channel outside our own systems for the response team, known to its members.	IM-09	No	Plan: out-of-band channel	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-DET-01	Detection and reporting	Everyone knows how to report a suspected event	One reporting route, in induction and reminded at least yearly; the no-blame rule is stated.	IM-01	No	Awareness training records; intranet reporting page	Head of Information Security	30 Sep 2026	Pass		OK
EXAMPLE	RC-DET-02	Detection and reporting	Reports reach someone who can act, at any hour	A report or alert out of hours reaches the incident manager directly, in time to start triage within 60 minutes.	IM-02	Yes	Monitoring provider's direct line to the incident manager in place since 10 Sep 2026 (PIA-05)	Head of Information Security	30 Sep 2026	Pass		OK
EXAMPLE	RC-DET-03	Detection and reporting	Security monitoring covers the systems that matter	Alerts from endpoints, email, identity and internet-facing systems go to a monitored queue around the clock.	IM-02	No	Monitoring service scope (SUP-006)	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-TRI-01	Triage and classification	Triage starts within the limit	Every report this quarter triaged within 30 minutes in working hours and 60 minutes outside them.	IM-02	No	Incident Case & Action Log: triage on time for all 5 cases	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-TRI-02	Triage and classification	Every incident is opened with a case number, manager, category and severity	The case log shows all four recorded at declaration.	IM-03	No	Incident Case & Action Log, Cases sheet	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-TRI-03	Triage and classification	Events closed at triage are recorded with a reason	Events and near misses closed without declaration are in the service desk with the reason.	IM-02	No	Service desk security queue	Head of IT	30 Sep 2026	Pass		OK
EXAMPLE	RC-TRI-04	Triage and classification	Severity is reviewed at every update	Updates record the severity; any lowering has a recorded reason.	IM-04	No	Case log: INC-2026-017 lowered from Severity 2 to 3 at 15:20, reason recorded	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-REP-01	Reporting duties	We know whether NIS2 applies to us, and how to report	Our entity status recorded; the CSIRT or authority, its reporting route and our account for it known and tested.	IM-06	Yes	Entity status: an important entity under NIS2 in its Member State; authority portal account tested	Legal	30 Sep 2026	Pass		OK
EXAMPLE	RC-REP-02	Reporting duties	We can meet GDPR's 72 hours	The Data Protection Officer is on the contact list; the supervisory authority's form is known; a breach record is kept for every breach, notified or not.	IM-06	Yes	Breach record; INC-2026-016 notified within 72 hours	Data Protection Officer	30 Sep 2026	Pass		OK
EXAMPLE	RC-REP-03	Reporting duties	DORA reporting is ready, if we are a financial entity	Classification criteria, the competent authority's template and the 4-hour and 24-hour clocks built into the screen.	IM-06	No	—	Legal	30 Sep 2026	N/A	Not a financial entity, so DORA's reporting duties do not apply.	OK
EXAMPLE	RC-REP-04	Reporting duties	Contract notification duties are known	A list of customers and partners whose contracts require notice of an incident, with the time each allows.	IM-06	No	Contract notification list	Legal	30 Sep 2026	Pass		OK
EXAMPLE	RC-REP-05	Reporting duties	The cyber insurer's notice conditions are known	Policy notice period, incident line and panel firms on the contact list.	IM-06	No	Insurer told 11:45 on the day of INC-2026-014	Chief Operating Officer	30 Sep 2026	Pass		OK
EXAMPLE	RC-REP-06	Reporting duties	The reporting screen is done on time, and reports are made on time	Screen complete within 4 hours of declaration; every report due this quarter made by its deadline.	IM-06	No	Incident Case & Action Log, Reports sheet: 4 of 4 on time	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-PLB-01	Playbooks	A playbook for each category that needs one	Ransomware Response Playbook, Business Email Compromise Response Playbook and Personal Data Breach Response Playbook approved and known to responders.	IM-12	No	Three playbooks approved	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-PLB-02	Playbooks	Playbooks carry the lessons of the last review	Every review action that changes a playbook is done by its due date.	IM-11	No	PIA-04: "Add site isolation steps for each warehouse to the Ransomware Response Playbook"	Information Security Manager	30 Sep 2026	Fail	PIA-04 is open, due 25 Sep 2026: 5 days overdue at 30 Sep 2026.	Put on the action list
EXAMPLE	RC-PLB-03	Playbooks	Payment changes are checked by a call-back	A request to change bank details is confirmed by calling a number already on file, never one in the request.	IM-12	No	Accounts payable procedure; INC-2026-015 stopped by the call-back	Chief Operating Officer	30 Sep 2026	Pass		OK
EXAMPLE	RC-PLB-04	Playbooks	Personal data breaches are assessed with the Data Protection Officer	The personal data breach playbook sets how risk to individuals is judged and who decides on notification.	IM-06	No	Personal Data Breach Response Playbook	Data Protection Officer	30 Sep 2026	Pass		OK
EXAMPLE	RC-EVD-01	Evidence and logging	Logs are kept long enough and responders can get them	Logs of key systems, email and identity kept for at least [[90 days]]; responders and suppliers can produce them on request.	IM-07	No	Log retention settings; INC-2026-017 mailbox audit log produced	Head of IT	30 Sep 2026	Pass		OK
EXAMPLE	RC-EVD-02	Evidence and logging	Evidence is preserved before systems are wiped	The playbooks say how to capture a disk, memory or mailbox before rebuilding, and who records the handling.	IM-07	No	Ransomware Response Playbook, evidence steps	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-EVD-03	Evidence and logging	System clocks agree	Servers, devices and cloud services use the same time source, so a timeline can be built.	IM-07	No	Time synchronisation settings	Head of IT	30 Sep 2026	Pass		OK
EXAMPLE	RC-EVD-04	Evidence and logging	Every incident has a case log with its timeline and decisions	The case log holds each case's timeline, decisions and who took them.	IM-03	No	Incident Case & Action Log: INC-2026-014 timeline, 20 entries	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-BKP-01	Backups and recovery	Backups of critical systems cannot be reached by an attacker	Offline or immutable copies of critical systems and data, restored in a test within the last 12 months.	IM-10	Yes	Backup provider report (SUP-011); restore during INC-2026-014	Head of IT	30 Sep 2026	Pass		OK
EXAMPLE	RC-BKP-02	Backups and recovery	Backups are checked before they are restored	The playbook and the backup provider check integrity before any restore.	IM-10	No	INC-2026-014: "Office work resumes on rebuilt PCs; backups checked before restoring"	Head of IT	30 Sep 2026	Pass		OK
EXAMPLE	RC-BKP-03	Backups and recovery	Recovery criteria are written down	The 5 criteria for returning to normal service, and the 7-day monitoring period before closure, are in the plan.	IM-10	No	Incident Response Plan, recovery criteria	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-COM-01	Communications	Approved message templates are ready	CT-01 to CT-10 approved, with the authority notification contents.	IM-09	No	Incident Communications Template Set	Communications lead	30 Sep 2026	Pass		OK
EXAMPLE	RC-COM-02	Communications	Only the communications lead speaks outside	Staff know not to talk to the media or post about an incident; the communications lead and a deputy are named.	IM-09	No	Staff handbook; awareness training	Communications lead	30 Sep 2026	Pass		OK
EXAMPLE	RC-SUP-01	Suppliers	Key suppliers' incident roles are agreed	The 5 Tier 1 suppliers the plan relies on know their role, must tell us of an incident within [[24]] hours and must help us.	IM-01	No	Contract clauses; roles for SUP-001, SUP-006, SUP-011, SUP-002, SUP-005	Head of Information Security	30 Sep 2026	Pass		OK
EXAMPLE	RC-SUP-02	Suppliers	Supplier out-of-hours contacts are on the contact list	Each key supplier's out-of-hours incident contact is listed and was checked.	IM-05	Yes	Contact list includes the monitoring provider's out-of-hours line (PIA-05, done 10 Sep 2026)	Information Security Manager	30 Sep 2026	Pass		OK
EXAMPLE	RC-SUP-03	Suppliers	Outside help can be called in at once	A retainer with an incident response firm, or the insurer's panel, with the authority to engage it agreed.	IM-08	No	Insurer's panel on the contact list; in INC-2026-014 its panel firm was not needed	Chief Operating Officer	30 Sep 2026	Pass		OK
EXAMPLE	RC-EXE-01	Exercises and learning	The plan was exercised in the last 12 months	An exercise of the plan (not a live incident) within the last 12 months, with its lessons recorded.	IM-12	Yes	Exercise report, 18 Mar 2026 (6 months ago)	Head of Information Security	30 Sep 2026	Pass		OK
EXAMPLE	RC-EXE-02	Exercises and learning	Every Severity 1 and 2 incident was reviewed on time	A post-incident review within 10 working days of closure.	IM-11	No	Reviews: INC-2026-014 27 Aug 2026; INC-2026-016 24 Sep 2026	Head of Information Security	30 Sep 2026	Pass		OK
EXAMPLE	RC-EXE-03	Exercises and learning	Review actions are owned and on track	Every action has an owner and a due date; none more than 30 days overdue.	IM-11	No	Incident Case & Action Log, Actions sheet	Head of Information Security	30 Sep 2026	Pass	PIA-04 5 days overdue, within the 30-day limit; PIA-01 in progress, due 31 Oct 2026; PIA-06 in progress, due 15 Oct 2026.	OK
EXAMPLE	RC-EXE-04	Exercises and learning	Risks an incident touched were reassessed	Each risk the review names was reassessed in the risk register.	IM-11	No	P05 risk R-04 reassessed 20 Aug 2026	Head of Information Security	30 Sep 2026	Pass		OK

Summary

Summary and sign-off

The results by area and overall, the readiness status, and the sign-off. Everything above the sign-off is calculated.

EXAMPLE: the example organisation's self-check, as at 2026-09-30. Clear the EXAMPLE answers to use your own.

Results by area

Area	Items	Pass	Fail	N/A	Status
Governance and plan	5	5	0	0	Ready
Roles and contacts	6	6	0	0	Ready
Detection and reporting	3	3	0	0	Ready
Triage and classification	4	4	0	0	Ready
Reporting duties	6	5	0	1	Ready
Playbooks	4	3	1	0	Ready, with actions
Evidence and logging	4	4	0	0	Ready
Backups and recovery	3	3	0	0	Ready
Communications	2	2	0	0	Ready
Suppliers	3	3	0	0	Ready
Exercises and learning	4	4	0	0	Ready
All areas	44	42	1	1	Ready, with actions

Status — Not ready: a Critical item failed. Incomplete: an item is not assessed. Ready, with actions: only non-critical items failed. Ready: every item passed or is N/A with a reason. Items without an Item ID are not counted.

Other counts

Count	Items
Critical items in the checklist	12
Fail or N/A without a reason	0

Sign-off

Role	Name	Date	Signature or approval reference
Checked by	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Reviewed by (Head of Information Security)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Result accepted by (Executive incident lead)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Next check due	[[Within 12 months, or after the next Severity 1 incident]]	[[YYYY-MM-DD]]

Lists

Result	YesNo	Area
Pass	Yes	Governance and plan
Fail	No	Roles and contacts
N/A		Detection and reporting

Triage and classification

Reporting duties

Playbooks

Evidence and logging

Backups and recovery

Communications

Suppliers

Exercises and learning

Definitions

Definitions

Term	Meaning in this workbook
Readiness	Being able to respond well to an incident before it happens: the plan, people, contacts, access, evidence, backups, reporting routes and suppliers in place and tested.
Pass	The evidence shows the item meets its 'Pass when' criterion today.
Fail	The evidence shows it does not, or there is no evidence. Give the reason and put it on the action list.
N/A	The item does not apply to you, for example DORA for an organisation that is not a financial entity. Give the reason.
Critical item	One without which the first hours of a serious incident would fail. A Fail on any makes the status Not ready.
Rule tested	The rule of the Security Incident Management Policy the item checks (IM-01 to IM-12).
Exercise	A planned rehearsal of the plan: a discussion of a scenario, a test of a part (a restore, a call tree), or a full simulation. A live incident is not an exercise.
Retainer	An agreement with an incident response firm, or the insurer's panel, to help at short notice on agreed terms.
Decision rights	Who may take the decisions with business impact in an incident, as the Incident Response Plan sets them.
NIS2	Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, as transposed in your Member State. Applies to essential and important entities.
GDPR	The General Data Protection Regulation, Regulation (EU) 2016/679. Applies whenever personal data is affected.
DORA	The Digital Operational Resilience Act, Regulation (EU) 2022/2554, with its Delegated Regulations (EU) 2024/1772 and 2025/301. Applies to financial entities only; for them its reporting replaces NIS2's.
CSIRT	Computer security incident response team: the national team (or the competent authority) that receives NIS2 reports.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Clear the EXAMPLE answers before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.24 — Information security incident management planning and preparation	The checklist as a whole: incident management planned and prepared, roles and procedures in place
ISO/IEC 27001:2022	Annex A 5.29 — Information security during disruption	Backups and recovery, and the crisis team: security maintained during disruption
ISO/IEC 27001:2022	Annex A 8.13 — Information backup	RC-BKP items: backups protected and restore tested
ISO/IEC 27001:2022	Annex A 5.5 — Contact with authorities	RC-REP items: the authorities to report to, and how, known in advance
NIST CSF 2.0	ID.IM-04 — “Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved”	Governance and plan, exercises: the incident response plan established, communicated, maintained and improved
NIST CSF 2.0	GV.SC-08 — “Relevant suppliers and other third parties are included in incident planning, response, and recovery activities”	RC-SUP items: suppliers included in incident planning, response and recovery
NIST CSF 2.0	RC.RP-03 — “The integrity of backups and other restoration assets is verified before using them for restoration”	RC-BKP-02: backups checked before they are restored
NIS2 — Directive (EU) 2022/2555	Article 21(2)(b) — the cybersecurity risk-management measures include “incident handling”	The checklist as a whole: incident handling in place as a risk-management measure
NIS2 — Directive (EU) 2022/2555	Article 21(2)(c) — “business continuity, such as backup management and disaster recovery, and crisis management”	Backups and recovery, crisis team: backup management, disaster recovery and crisis management
DORA — Regulation (EU) 2022/2554	Article 17(3) — early warning indicators; procedures to log, categorise and classify incidents; roles for each incident type; communication plans; reporting major incidents to senior management and the management body; response procedures	Tailoring for financial entities: roles, communication plans, reporting to the management body and response procedures in place

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA), Delegated Regulations (EU) 2024/1772 and 2025/301, Implementing Regulation (EU) 2025/302