Written incident response plan

The incident response plan is the written document that says who does what when an alert becomes an incident: the incident lead and their backup, the decision cell, the decision tree (contain or watch, cut the internet link, pay or not, notify or not). It also sets the thresholds that trigger notification under Article 23 of Directive (EU) 2022/2555 or Article 33 of Regulation (EU) 2016/679, and the contacts. On April 3, 2025, NIST (National Institute of Standards and Technology) released Revision 3 of Special Publication 800-61, which supersedes the 2012 incident handling guide (Revision 2) and maps incident response onto the six Functions of the Cybersecurity Framework 2.0. Contacts are the weak link. A plan stored on the encrypted file server will not open; it has to exist on paper and off the domain, with the carrier's claims hotline, the breach coach, the forensic firm on retainer, and the steps for filing a police complaint. The cyber application usually asks whether a plan exists and whether it has been tested. Answering yes on a plan never exercised is a misrepresentation, exposing the insured to the remedies for false statements in the application, from proportional reduction to rescission depending on good or bad faith. At claim time, the effect is more diffuse than an exclusion. Without a plan, the insured calls an off-panel vendor, incurs costs without prior consent, restores before preserving the logs; each of those moves hands the carrier an argument for reducing incident response costs. The underwriter therefore reads the plan as a clue to the likely length of the outage, and the last tabletop exercise as proof that it holds. One caveat: the lack of a plan does not by itself void cover when the application never asked about one.