Glossary
Incident response plan
Also called: IRP, security incident response plan
In one sentence
A written, step-by-step plan for what your business does when a security incident happens — who to call, what to shut off and what to record.
An incident response plan tells everyone what to do in the first chaotic hours of a security problem: a ransomware note on a screen, a mailbox sending phishing emails, a lost laptop, a suspicious wire-transfer request. Good plans are short, specific and printed — because the computers might not be available when you need them.
A typical small-business plan covers: how staff report something suspicious; who’s in charge; first containment steps (disconnect the affected PC, reset the compromised password); who to call — your IT provider, your cyber insurance carrier’s hotline (often before you hire anyone else), your bank if money moved, law enforcement; how to preserve evidence; and how decisions about notifying customers, patients or regulators get made.
Regulations expect this. The HIPAA Security Rule requires security incident procedures, and the HIPAA Breach Notification Rule sets deadlines for notifying patients and HHS. The FTC Safeguards Rule requires covered financial businesses to have a written incident response plan. Insurers increasingly ask whether you have one, too.
Example: a receptionist reports an odd password prompt. Because the plan is posted, she calls the IT provider immediately instead of ignoring it; the account is locked, sessions are revoked and the insurer is notified within the hour. Build yours with our HIPAA breach response plan guide.
Related terms
- Disaster recovery (DR)The plan and tools for getting your systems and data back after a serious failure such as ransomware, a fire, a flood or a dead server.
- Cyber insuranceInsurance that helps pay for the costs of a cyberattack or data breach — investigation, recovery, notification, legal costs and sometimes lost income.
- RansomwareRansomware is malicious software that locks or encrypts your files and systems, and often steals copies of your data, so criminals can demand payment to restore access or keep quiet.
- Business email compromise (BEC)Business email compromise is a fraud where criminals impersonate or take over a real business email account to trick staff, clients or vendors into sending money or sensitive information.
- HIPAA Security RuleThe HIPAA Security Rule is the federal regulation that sets the administrative, physical and technical safeguards healthcare providers and their vendors must use to protect electronic patient information.