Cyber incident response plan: printable template

Last updated: 18 October 2026 · IT-Checklist editorial team · All changes

An emergency plan, also called an incident response plan, for small businesses and freelancers is mostly a list of names, numbers and steps. When your business gets hacked or data leaks out, you have to make decisions fast. That is exactly when you can't think straight. Your email and computers may be down too, and a plan stored on your server is no use then. That's why this emergency plan is meant to be kept on paper.

Fill in the fields below now, while nothing is wrong. Then print it or save it as a PDF. Keep one copy at the office and one at home. Go through it every six months, because phone numbers and contacts change.

Whatever you type in the fields ends up on the printout. Nothing is saved, so print it or save the PDF before you close the page.

Cyber incident emergency plan

CompanyFilled in on

1. Fill in beforehand

Who do you call and where do you find what? Fill this in before anything happens.

Who decides

NamePhoneStand-inStand-in phone

IT partner

Company and contact personPhone (also out of hours)Contract or customer number

Cyber insurance

InsurerPolicy numberClaims phone number

Bank

BankFraud line phone number

Hosting, domain and email

Website and domain providerPhone or customer numberEmail providerEmail phone or customer number

Key systems

System	How long can you do without it?

Backups

Where are the backups?Who can restore them? (name and phone)

Recovery codes and passwords

Where are recovery codes and the master password kept offline?

2. The first hour: step-by-step plan for a cyber incident

Time discoveredDiscovered by

Write down the time and what you see. Take a photo of the screen with your phone.
Take affected devices off the network: unplug the cable and turn off Wi-Fi. Don't switch them off, because that wipes traces in memory.
Call the person who decides and your IT partner. Their numbers are in part 1.
Not sure what to do about ransomware? Don't pay a ransom and don't talk to extortionists without advice from your IT partner, your insurer or the police.
Change the passwords for your email and bank from a device that is not affected.
Turn on two-step verification (MFA) for accounts where it is still off.
Warn your colleagues. They don't open suspicious email, don't forward anything and don't log in through links.

3. Reporting a data breach or cyber attack: within 24 to 72 hours

Has personal data leaked and is there a risk to the people it is about? Report it within 72 hours of discovery to the Autoriteit Persoonsgegevens (AP), the Dutch Data Protection Authority. You can only do that online, through the form on autoriteitpersoonsgegevens.nl. If in doubt, report it.
Does your business fall under the Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw, the Dutch NIS2 law)? Report a significant incident at mijn.ncsc.nl. Send an early warning within 24 hours, the notification within 72 hours and the final report within a month of your notification. Your report then also reaches your sector CSIRT and your supervisor.
Not covered by the Cbw? You can still report an incident voluntarily to the NCSC, the Dutch National Cyber Security Centre, at ncsc.nl.
Report the damage to your cyber insurer and ask what they need from you.
File a police report. Call 0900-8844 to make an appointment. Keep every trace, such as emails, log files and photos of the screen.
Has money gone missing or do you see a strange payment? Call your bank's fraud line right away.
Is the risk high for the people whose data leaked? Then tell them. Explain what happened and what they can do themselves.

Reported to	Date and time	Reference or contact name
Autoriteit Persoonsgegevens
NCSC
Insurer
Police
Bank

4. Communication

Who talks to customers and the press?Who informs staff, and how if email is down?

Standard message for customers (edit it now)

Say nothing about the cause or who did it until you know for sure.
Keep track of who you told what, and when.

5. Recovery

Clean or reinstall affected systems before you restore a backup.
Check first that the backup is complete and clean. Pick a backup from before the attack.
Restore systems in the order from part 1: the one you can do without the shortest goes first.
Renew all passwords, API keys and access tokens. Remove accounts you don't recognise.
Watch for a repeat in the weeks after, such as strange login attempts, new forwarding rules in your email and unknown software.

6. Afterwards

Plan a review within 2 weeks with everyone who was involved.
Write down what went well and what went wrong.
Update this emergency plan with what you learned.

Review dateNext review date for this plan

7. Important numbers (Netherlands)

Who	How to reach them
Police, emergency or danger	112
Police, report a crime or make an appointment (non-urgent)	0900-8844
Fraudehelpdesk (Dutch fraud helpdesk)	088-786 7372 (weekdays, hours on fraudehelpdesk.nl)
Autoriteit Persoonsgegevens, report a data breach	Online only: breach form on autoriteitpersoonsgegevens.nl
Autoriteit Persoonsgegevens, questions from organisations about reporting a breach	088 - 1805 255
NCSC, report a cyber incident (businesses too)	Form on ncsc.nl or cert@ncsc.nl (24/7)
NCSC, reporting under the Cbw	mijn.ncsc.nl
NCSC, general questions	070 751 55 55 (weekdays)

The Digital Trust Center became part of the NCSC on 1 January 2026. Numbers checked on 18 October 2026. Check them again when you review this plan.