SMALL SAAS INCIDENT RESPONSE PLAN — BLANK TEMPLATE
Original planning worksheet. Checked 2026-10-28.
https://showmeyoursaas.com/articles/incident-response-plan/
References:
https://csrc.nist.gov/pubs/sp/800/61/r3/final
https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes
Adapt to the actual service, authority, and specialist arrangements before operational use.

SCOPE AND PREPARATION
Services and environments covered:
Security incidents and ordinary service incidents:
Signals that require security escalation:
Plan owner / version / review trigger:
Approved evidence system:
Authorized contact location available during an outage:
Fallback communication arrangement:
Related operational procedures and tested recovery paths:
Training or exercise record:

ROLES AND EXISTING AUTHORITY
Incident coordinator / fallback:
Technical service owner / fallback:
Authorized containment decision owner:
Security responder or external specialist route:
Evidence custodian:
Communications owner:
Qualified legal/contractual/insurance support route:
Record actual contact details in the controlled operational system, not a public template.

INITIAL RECORD
Incident reference:
Reporter / detection time:
Start of observed impact (unknown is allowed):
Affected service and permitted scope:
Known observations:
Suspicions needing investigation:
Current customer impact:
Potential access/data concern:
Evidence references and access restrictions:
Next decision owner:

TRIAGE
What changed?
What evidence supports the suspected classification?
Which threshold or condition triggers escalation?
Who decides when evidence is ambiguous?
What should not be stated as confirmed?
Do not copy secrets or private payloads into a broad incident channel.

CONTAINMENT DECISION
Proposed action:
Existing authority:
Expected protective effect:
Service consequences and dependencies:
Evidence to preserve first through the approved process:
Action owner:
Actual permitted action and time:
Verification:
Queued or already accepted work remaining:
No universal command sequence is provided by this template.

RECOVERY
Conditions required before restoration:
Permission and credential state checks:
Synthetic authorized task:
Monitoring evidence:
Unresolved exposure question and specialist owner:
Approval / action / verification:
Remaining containment:
Handoff:

COMMUNICATION
Internal audience and channel:
Customer-facing owner and approval:
Known impact:
Action in progress:
Uncertainty:
Next update point:
Qualified route for situation-specific notification obligations:
Do not invent a universal notification deadline or declare no exposure without supporting evidence.

LEARNING
Stable response state:
Preserved timeline:
RCA reference:
Corrective action / owner / verification:
Exercise or incident gap:
Plan revision:
Next review trigger:
A completed planning document is not a compliance certification or proof that recovery works.