Roles & responsibilities
Who leads, who decides, who communicates — including deputies.
Cybersecurity & compliance
An incident response plan your team can actually use
When a security incident happens, there is no time to figure out who decides what. We develop your incident response plan together with IT, management and other stakeholders — clear, tested and connected to your ISMS.
What goes wrong in real incidents
- Nobody knows who is allowed to take systems offline
- Management is informed too late — or too early without facts
- External contacts (insurer, IT service provider, authorities) are not at hand
- Reporting deadlines are missed because nobody tracks the clock
- Evidence is lost while systems are restored
- Lessons learned never make it back into the risk assessment
What the plan covers
Escalation structure
When an event becomes an incident, and when an incident becomes a crisis.
Classification
A simple scheme to assess severity and priority quickly.
Communication paths
Internal and external communication, including templates.
Contact directory
Internal contacts and external partners such as IT providers, insurers, forensics, legal counsel and authorities.
Reporting procedures
Regulatory reporting timelines (e.g. NIS2, CRA, GDPR) mapped to clear steps.
Documentation & evidence
What to record during an incident and how to preserve evidence.
Lessons learned
A structured review that feeds back into risks and corrective actions.
How we develop the plan
-
Understand
Systems, dependencies, existing processes, service providers and obligations.
-
Design together
Workshops with IT, management and other stakeholders to agree on roles and decisions.
-
Document
A concise plan and playbooks for likely scenarios — usable under stress.
-
Test
Tabletop exercises to walk through realistic scenarios where appropriate.
-
Integrate
Link to the ISMS: risk assessment, corrective actions, awareness and reviews.
What we do — and what we do not replace
We help you plan and prepare. We are not a 24/7 emergency response team and do not replace your IT department, security operations center, forensics provider or legal counsel. A good plan defines exactly when and how you involve them.
Incidents as a source of improvement
Every incident should make the ISMS better
The plan does not end with recovery. It closes the loop back into the management system.
- Incident
- Response
- Documentation
- Lessons learned
- Risk reassessment
- Corrective action
- ISMS improvement
What you get out of it
- Clear decisions and responsibilities before an incident happens
- Reporting obligations translated into concrete steps
- Incidents that improve your ISMS instead of just being closed
Frequently asked questions
What should an incident response plan contain?
At minimum: scope and definitions, roles and responsibilities, escalation and decision rules, a classification scheme, communication paths and contacts, reporting obligations and deadlines, documentation and evidence requirements, and a lessons-learned process. Scenario playbooks help for the most likely incident types.
Is an incident response plan required?
ISO/IEC 27001 requires planned incident management. NIS2 requires incident handling and reporting; affected entities must submit an early warning within 24 hours. The Cyber Resilience Act sets reporting obligations for manufacturers. In practice, a plan is the only way to meet these deadlines reliably.
Do you help during an actual incident?
Our focus is preparation and improvement. During an acute incident you need your IT, specialized emergency responders and — where relevant — forensics and legal counsel. Your plan should name them in advance.
Related services
Related services
ISMS & ISO 27001
Build a working ISMS and prepare for ISO/IEC 27001 certification — together with your team and on top of the tools you already use.
Security Awareness & Training
Awareness training connected to your ISMS, policies and systems — so employees understand not only what to do, but why.
Cybersecurity Compliance
Understand which cybersecurity regulations apply, identify the gaps and implement practical technical and organizational measures.
Related reading
What should an incident response plan contain?
What an incident response plan must contain: roles, escalation, communication, NIS2 and CRA reporting deadlines, evidence and lessons learned.
Recap: IT Managers Meeting at IHK Darmstadt — security monitoring along the Cyber Kill Chain
Recap of the IHK Darmstadt IT managers meeting: FeldmannCyber on IT security monitoring along the Cyber Kill Chain — scans, monitoring and SIEM.
What happens after ISO 27001 certification? ISMS maintenance explained
Certification is not the finish line. What ISMS maintenance involves, which activities recur every year, and how to avoid the pre-audit panic.
No incident response plan yet — or never tested?
Let us build one with your team before you need it.