Incident Response Plan
Quick answer
An incident response plan is a short written set of steps a business follows when something goes wrong — a serious safety incident, a cyber attack, a heat emergency, a fire, a customer injury. It answers three questions in advance: who is in charge, what happens in the first hour, and who gets contacted.
What an incident response plan is
An incident response plan is a short, practical playbook for the first minutes and hours after something serious happens. It names the person in charge, lists the immediate actions in order, includes emergency contacts, and states clearly what — and what not — to say publicly.
The whole point of writing it down is that when something serious happens, decision-making capacity drops. A plan removes the need to figure it out under pressure.
Why every small business should have one
Serious incidents are rare — but every business will face at least one. The presence or absence of a written plan is usually the single biggest factor in how well the business handles it. Insurance, regulators and (increasingly) customers will all ask whether one exists.
Common mistakes
Only planning for cyber incidents
The same plan structure works for safety incidents, heat emergencies, floods, staff injuries and public-facing incidents. One template, many scenarios.
Frequently asked questions
- How long should an incident response plan be?
- One to three pages per scenario. Anything longer stops being used when it is needed most.