Incident Response Plan Sample: Turn a Binder Into a 60-Minute Tabletop

Put your plan in front of the people who’ll use it. Spend one hour finding the assumptions that won’t survive an outage.

Key Takeaways:

• What does an incident response plan sample include?
• How do you run a tabletop exercise?
• Which gaps should leadership document afterward?

Your backup contact list is safely stored in the company drive. There’s just one problem: the company drive is down.

A written plan can look complete until someone needs to use it. A cybersecurity tabletop exercise exposes those awkward handoffs while the stakes are still hypothetical.

Use this incident response plan sample and 60-minute agenda to rehearse one disruption, find practical gaps, and leave with fixes someone owns.

Need help running the rehearsal? Call (855) 965-3231 or contact our team to plan a focused tabletop.

What Does an Incident Response Plan Sample Include?

A useful sample connects an incident trigger to people, reporting routes, action boundaries, evidence, and recovery checks. It gives the team something concrete to walk through.

This fictional example covers a 40-person professional-services firm losing access to shared project files. It’s a starting excerpt, not a complete policy.

Plan element	Example response
Scope and trigger	Lost file access and a reported ransom message trigger escalation. The operations manager activates the plan.
Lead and deputy	The operations manager leads the business response; the office manager is the deputy. The I.T. provider assesses the incident within its agreed responsibilities.
Reporting and coordination	Employees report through the known support number. If email is unavailable or untrusted, responders use an agreed phone bridge and approved offline contacts.
Containment authority	Trained responders isolate affected devices within documented authority. Wider interruptions follow agreed emergency authority and escalation rules. Employees don’t improvise shutdowns or erase devices.
Outside help and communications	Finance checks emergency spending and insurer requirements. The incident lead involves counsel as appropriate. The authorized spokesperson approves customer updates.
Evidence and recovery	Technical responders preserve evidence. A note-taker records decisions. Recovery requires technical validation and the business owner’s check of the priority workflow.

What’s my action item? Substitute your real roles, channels, and authority limits. Mark unknowns instead of guessing.

What Do You Need Before the 60-Minute Session?

A tabletop is a facilitated discussion, not a live attack simulation. Discuss technical actions and outside responses; don’t shut down systems or make surprise emergency calls.

Prepare before the clock starts:

• Gather the current plan, contacts, provider escalation details, fallback communication method, and approval rules.
• Invite the business lead, operations, your I.T. provider, and relevant finance or compliance representatives.
• Appoint a facilitator and a separate note-taker. Brief everyone on their role.
• Choose three objectives: find the reporting route, explain fallback access, and identify an authorized next action.

CISA’s tabletop exercise resources include facilitator guidance and feedback templates. NIST’s exercise guide provides a broader planning framework.

The hour below is a suggested workshop format, not an official standard or a recovery-time promise.

Minutes 0–5: Establish the Rules and the Starting Point

Introduce the fictional firm and this starting scenario:

A project team can’t open shared files. An employee reports a ransom message. A customer deliverable is due today; the cause and full scope remain unconfirmed.

Ask participants to use the plan they have today, not the improved version they wish they had.

For each proposed action:

1. Explain what you’d do.
2. Show the instruction or authority that supports it.
3. Identify the information you still need.

The facilitator introduces updates; the note-taker captures decisions and uncertainties. Keep discussions tied to the three objectives.

Make it safe to say, “I don’t know.” A strong cybersecurity culture rewards early reporting and honest questions. Finding confusion now is useful progress, not a reason to assign blame.

What’s my action item? Put the three objectives where everyone can see them.

Minutes 5–15: Follow the First Report Through the Plan

Ask the employee how they’d report the problem, what they’d include, and who takes responsibility next. Ask the incident lead what activates the plan.

Have participants locate the actual contact and escalation instructions. “I know who to call” isn’t enough if nobody else can find the number.

Record missing, outdated, or inaccessible information. Distinguish a documented route from a workaround someone remembers.

Before moving on, name the next responsible person and separate known facts from assumptions about the incident.

What’s my action item? Capture one instruction that someone couldn’t reliably follow under pressure.

Minutes 15–30: Introduce a Communication and Approval Problem

Introduce two complications: company email is unavailable, and the primary approver can’t be reached.

Can participants find the approved fallback channel without signing into the unavailable account? A contact list behind the same locked door isn’t much of a fallback.

Ask the deputy to explain their authority. Would the provider know which actions it can take immediately and which require escalation?

Don’t invent access or permission to keep the story moving. Record the blocker, then state any assumption needed to continue the discussion.

Compare the provider’s agreed responsibilities with the plan. A gap between those documents needs an owner on both sides of the handoff.

What’s my action item? Label the blocker: missing access, unclear authority, outdated information, or an untested assumption.

Minutes 30–45: Add a Vendor Delay and a Customer Question

The software vendor acknowledges the issue but has no recovery estimate. The customer wants to know whether today’s deliverable will arrive.

Who follows up with the vendor? Who approves the customer update? Ask both people to explain their next step.

Draft a short update using confirmed facts, the current business impact, and the time of the next update. Don’t guess at a recovery deadline.

Discuss whether an approved workaround exists. Make its limits clear so helpful employees don’t create new risks while trying to finish the job.

What’s my action item? Record one external dependency, its escalation route, and the person responsible for following through.

Minutes 45–55: Debrief While the Details Are Fresh

Pause the scenario and ask:

• What worked without improvisation?
• Where did we hesitate?
• Which assumption turned out to need evidence?

Compare those answers with the three objectives:

• Could people find the reporting route?
• Could they explain fallback access?
• Was the next authorized action clear?

Simon Lee, founder of app strategy and design agency Affective, described a phishing rehearsal where the team assumed backups were ready until the facilitator asked who had checked.

“We don’t know for sure what we’d be recovering that afternoon,” Lee recalled.

That’s the distinction to capture: confidence in a tool isn’t evidence that someone can use it. A discussion can expose the missing check; it can’t replace a restore test.

What’s my action item? Prioritize gaps that could delay reporting, coordination, or an essential business decision.

Minutes 55–60: Assign the Fixes and the Follow-Up

Give each priority gap a correction, one accountable owner, a deadline, and a way to verify completion.

Protect these five minutes. If discussion runs long, park unresolved issues for follow-up rather than leaving with a list that belongs to nobody.

What’s my action item? Schedule the review before everyone leaves and confirm who owns each priority fix.

Which Gaps Should Leadership Document Afterward?

Write findings so someone who missed the workshop can understand what failed and what success will look like.

In our fictional firm, the fallback contact list requires the unavailable company account. Here’s a completed example of the resulting improvement record:

The deadline below is illustrative; choose yours based on the gap’s urgency.

Observed Gap	Fallback contacts require the unavailable company account.
Business Consequence	The team can’t locate the deputy’s number through the approved fallback route.
Required Correction	Create an approved, access-controlled copy available without that account. Brief the relevant roles.
Accountable owner	Operations manager, with the I.T. provider supporting access controls.
Target	Within 10 business days of the exercise.
Verification	The deputy finds the contacts without the normal account and explains the next step in a follow-up walkthrough.

Keep a short record of the result. If the deputy still can’t use the fallback, the correction isn’t finished.

What’s my action item? Replace “improve communication” with a specific gap, correction, owner, deadline, and check.

How Do You Know the Exercise Led to Improvement?

Update the plan and affected contact lists, then make the revised version easy to find. Rehearse the failed handoff again before marking it resolved.

Lee’s team assigned someone to perform and document monthly test restores after its rehearsal. Three months later, those checks uncovered a silent failure that needed attention.

“Having a tool doesn’t mean anything without someone to own it, test it, and know how long it’ll take to recover everything,” Lee said.

That was his team’s testing schedule, not a universal rule. Agree on suitable verification with your I.T. provider, then keep evidence of the result.

What’s my action item? Ask what changed, who checked it, and what the follow-up demonstrated.

Frequently Asked Questions

1. What does an incident response plan sample include?

It identifies the trigger and scope, lead and deputy, reporting routes, communication fallback, action authority, evidence responsibilities, and recovery checks.

2. How do you run a tabletop exercise?

Prepare one realistic scenario, the current plan, and a few objectives. Appoint a facilitator and note-taker, discuss the updates, and record gaps.

Reserve time to debrief and assign corrections. Keep technical actions and outside responses hypothetical during the session.

3. Which gaps should leadership document afterward?

Record inaccessible information, unclear authority, unavailable deputies, failed handoffs, assumed vendor capabilities, and unclear customer updates. Give each priority gap an owner and a verification step.

4. Does a 60-minute tabletop prove the company is ready?

No. It tests understanding and coordination within a limited scenario. It doesn’t prove backups will restore, replace broader exercises, or establish compliance.

The Useful Result Is What Changes Afterward

A useful rehearsal turns “We’d call I.T.” into a route people can actually follow.

The real result comes afterward: clearer instructions, accountable owners, and a check that each correction works.

Keep that improvement cycle going. A plan earns trust when the team can use it and keeps learning from the places it falls short.

What’s my action item? Choose one essential workflow, gather the current plan, and book the rehearsal.

Run a Guided Tabletop Exercise

Attentus helps teams turn uncertainty into clear next steps. Explore our cybersecurity services, then contact us about a guided tabletop and practical follow-through.