In an emergency there is no time to settle basic questions. Who may take systems offline? Who informs customers? Who reports to which authority? An incident response plan answers these questions in advance so that people act rather than debate. NIST describes in SP 800-61 Revision 3, revised in 2025, how incident response is embedded in overall cybersecurity risk management.
Roles and reachability
A plan names the incident lead and deputy, technical contacts, communications, legal advice and external partners such as IT providers, forensics and insurers, each with contact details reachable even without working email. Decision rights matter just as much: who may shut down a service, who assesses a ransom demand, who approves a public statement?
Classification and immediate measures
Not every incident is a crisis. A simple impact classification separates routine from emergency and defines when the plan is fully activated. For the most common scenarios, such as ransomware, a compromised account or data exfiltration, concrete immediate measures belong in the plan: isolate, preserve evidence, lock access, protect backups.
Reporting duties with deadlines
The plan lists all reporting channels side by side: the Swiss reporting obligation to the federal office within 24 hours for critical infrastructure, notification of the FDPIC under Art. 24 FADP as soon as possible where there is a high risk to data subjects, the 72-hour period under Art. 33 GDPR for controllers subject to the GDPR, the NIS2 deadlines and sector reports, for example to FINMA. Our data breach response checklist covers the data protection part.
Recovery and exercises
Recovery means restoring systems from clean backups in a defined order, aligned with RPO and RTO. A plan never exercised fails on details: outdated phone numbers, backups whose restore was never tested, responsibilities nobody knows. A tabletop exercise once a year with a realistic scenario uncovers these gaps before an attacker does.
Further reading
Beyond the response, business continuity management governs how the business keeps running. The plan is exercised in a tabletop exercise; duties towards a cyber insurer belong in it.