# Incident Response Plan Template for Small Regulated Firms

URL: https://limehawk.io/reports/incident-response-plan-template
Published: 2026-10-02
Author: Corey Watson, Managing Member
Topic: Guides
Read time: 7 min

A small-firm incident response plan needs eight sections: roles, declaring an incident, containment, outside calls, notices, evidence, recovery, and review.

> **TL;DR** An incident response plan is a short written document that says who does what when something goes wrong. For a 5 to 100 user firm it needs eight sections: roles and contacts, how to declare an incident, containment steps, who calls the bank, insurer, and counsel, notification duties, evidence, recovery, and an after-action review. The FTC Safeguards Rule and amended Reg S-P both require a written plan or program. Below is an outline you can copy into your own doc, plus how our published BEC response lines up with it.

- Areas FTC 314.4(h) names: 7

## What is an incident response plan?

An incident response plan is a written document that tells your people what to do before, during, and after a security incident. It names who is in charge, who gets called, how you stop the damage, and how you write it all down. CISA's [Incident Response Plan Basics](https://www.cisa.gov/sites/default/files/publications/Incident-Response-Plan-Basics_508c.pdf) describes it as a written document "formally approved by the senior leadership team."

It doesn't need to be long. A small firm's plan fits on a few pages. What matters is that it exists before the bad morning, that the people named in it have read it, and that it's printed somewhere you can reach when the network isn't working.

The federal reference is NIST [SP 800-61 Revision 3](https://csrc.nist.gov/pubs/sp/800/61/r3/final), published April 2025. It replaced Revision 2 from 2012 and now ties incident response to the NIST Cybersecurity Framework 2.0. It's written for organizations much bigger than yours, so use it as background, not as a form to fill out.

## Which rules require a written incident response plan?

If you're a financial institution under the FTC Safeguards Rule, [16 CFR 314.4(h)](https://www.ecfr.gov/current/title-16/part-314/section-314.4#p-314.4(h)) requires a written incident response plan. It names 7 areas the plan has to address: goals, internal response processes, roles and decision authority, communications, fixing identified weaknesses, documentation and reporting, and revising the plan after an event. That covers tax preparers and many [accounting firms](/industries/accounting-firms). Firms holding data on fewer than 5,000 consumers are exempt from that paragraph under 314.6. Our [FTC Safeguards guide](/reports/glba-safeguards-rule-small-firms) covers the exemption and the 30-day FTC notice.

SEC-registered advisers fall under amended Regulation S-P. [17 CFR 248.30(a)(3)](https://www.ecfr.gov/current/title-17/part-248/section-248.30#p-248.30(a)(3)) requires a written program to assess an incident, contain it, and notify affected individuals. We broke down the deadlines and vendor rules in our [Reg S-P guide](/reports/regulation-s-p-amendments-ria).

Even if no rule requires a plan, write one anyway. You'll want it the first time an inbox gets taken over.

## What sections does a small-firm incident response plan need?

A small-firm plan needs eight sections. Copy this outline into your own document and fill in the blanks. Keep each section short enough that a stressed person can follow it.

1. **Roles and contacts.** Name an incident lead who runs the response and makes decisions, a technical lead (your IT provider or in-house IT), and someone who handles communications. Name a backup for each one. List phone numbers for your IT provider, bank, cyber insurance carrier, attorney, and key vendors. Note who can approve destructive steps like wiping a device or shutting down a system. CISA's advice is to print the list and give a copy to everyone with a role, because "your internal email, chat, and document storage services may be down or inaccessible."
2. **How to declare an incident.** Say what staff should report (odd sign-in prompts, a missing laptop, a client asking about changed wire instructions) and who they tell, by phone. Say who decides it's an incident, and that a false alarm is fine.
3. **Containment.** Write the first moves for your likely scenarios: a compromised email account, a lost or stolen device, ransomware. For an account, that's reset the password, end every session, and check for mail rules and forwarding. For a device, it's locate, lock, or wipe.
4. **Who calls the bank, insurer, and counsel.** Assign each call to a named person. If money moved, call the bank first. The FBI's IC3 says to [contact the originating financial institution](https://www.ic3.gov/CrimeInfo/BEC) "as soon as fraud is recognized to request a recall or reversal," then file a complaint at ic3.gov. Check your cyber policy for when and how the carrier wants to hear from you. CISA also suggests reviewing the plan with your attorney, who may have preferences about outside responders and law enforcement.
5. **Notification obligations.** List which notices could apply to you and who decides: clients, regulators, and state breach laws. Write down where the deadlines come from. Don't guess them during the incident.
6. **Evidence.** Say what to preserve before anything gets cleaned up: sign-in logs, the suspicious emails, mail rules, ticket notes, and who approved what and when. Keep a running timeline as you go.
7. **Recovery.** Define what "back to normal" means: accounts reset and verified, devices rebuilt or restored from a tested backup, and the gap that let the attacker in closed.
8. **After-action review.** Meet within a couple of weeks. Walk the timeline, decide what to change, and update the plan. CISA says these reviews "must be blameless." Under 314.4(h), revising the plan after an event is one of the required areas.

At the top of the document, add a line for the approval date and the next review date. CISA suggests reviewing the plan quarterly and running a tabletop exercise, where you talk through a fake incident as a team.

## How does a real incident map to the template?

Our [BEC wire fraud report](/reports/bec-wire-fraud-incident-response) covers almost every section. An attacker took over a title company closer's inbox and sent fake wire instructions on a real closing.

- **Declare:** the owner called us right away instead of trying to sort it out internally. That call is the reason we had time.
- **Contain:** we forced a password change, ended every active session, and removed the two mail rules the attacker had set up to hide replies.
- **Outside calls:** we phoned the closing agent on the other side and told them to disregard the fraudulent instructions. That call stopped the loss. The wire was never sent, so no bank recall was needed.
- **Evidence:** we traced the sign-in, then checked for and ruled out connected apps, app passwords, forwarding rules, and malware on the laptop.
- **Recovery:** the same day, we enforced 2-Step Verification across the whole tenant.
- **After-action:** the firm adopted a written rule that any change to wire instructions gets verified by phone to a number on file.

Our [stolen laptop report](/reports/mdm-remote-wipe) shows the roles section in action. Before we wiped the device, we got verbal authorization from the sales director and recorded it in the ticket. Decision authority was clear, and the paper trail was there afterward. The wipe ran 16 minutes after the theft was reported.

## Key takeaways

- A small-firm plan needs eight sections: roles and contacts, declaring an incident, containment, outside calls, notification, evidence, recovery, and after-action review.
- FTC Safeguards 16 CFR 314.4(h) requires a written plan covering 7 areas. Firms with data on fewer than 5,000 consumers are exempt from that paragraph, but the plan is still worth having.
- Amended Reg S-P requires a written incident response program that assesses, contains, and notifies affected clients.
- Print the contact list. During an incident, the email and file shares you'd look it up in may be the thing that's down.
- Write down who can authorize destructive steps like a remote wipe, and record that approval in the ticket before you act.

## What this looks like when we do it

We write the IT half of the plan with you, as part of our [compliance and backup work](/services/compliance-backup): who calls us, how we contain a compromised account or a lost device, which logs we pull, and where the evidence lands. You own the business half, including the bank, the insurer, your attorney, and the decision on client notices. We'll go through both halves with you before you need them.

When something does happen, critical issues get a response in under 15 minutes, and every decision goes into the ticket so the after-action review has a real timeline to work from. The [compliance and backup page](/services/compliance-backup) covers the rest of the documentation insurers ask for.

If you need a plan written, or you want a second set of eyes on the one you have, book a call.