Setting up an incident response team: printable checklist

Last updated: 27 October 2026 · IT-Checklist editorial team

An incident response team is the group of people who step in when your business is hacked, hit by ransomware or leaks data. Even a small business needs one. They don't have to be specialists. You do need to agree beforehand who decides, who does what and who you call from outside.

Use this checklist to set up the team. The emergency plan covers what to do in the first hour, this one covers who does it. Fill it in with the team members, print it and give everyone their own copy. Practise at least once a year.

What you type in the fields is included in the print. Nothing is stored, so print or save the PDF before you close the page.

Rather fill it in on your computer? Download the blank PDF with form fields, fill it in with a PDF reader such as Adobe Acrobat Reader and save it.

1. Who declares an incident?

Someone has to say: this is an incident, the team takes over. Usually that is the director or someone from the management team. Also agree in which situations that happens.

May declare an incidentBackupWhen is it an incident? (e.g. ransomware screen, suspicious login on an admin account, customer data leaked, systems down for more than 1 hour because of an attack)

2. Roles in the team

Give every role a name and a backup. Few people? Then combine roles. Only the lead and the log keeper must be two different people.

Role	Name	Phone	Backup
Lead: makes decisions and keeps the overview
IT: isolates systems and keeps evidence
Communication: colleagues, customers and press
Legal and privacy: reporting duty, GDPR, contracts
HR: when an employee is involved
Log keeper: writes everything down with the time

3. Outside help

The Dutch NCSC mainly helps you find out what is going on. For cleaning up and recovery you need a specialist incident response firm. Arrange one beforehand, while things are calm.

Incident response firm or CSIRT

CompanyPhone 24/7Contract or framework agreement numberWhat they do (e.g. forensics)

IT partner and hosting

IT partner and phoneHosting and phone

Cyber insurance

Insurer and policy numberClaims phoneWhat help does the insurer arrange itself? (many policies have a fixed incident response firm)

4. Reachability and fallback channel

Fallback channelPlace to meet

Every team member has a printed copy of this plan and the emergency plan, also at home.
We have a fallback channel that does not run through our own email or Teams, e.g. a chat group with private numbers.
There is a fixed place to meet, and an online alternative if you can't get there.
We know how to reach the team outside office hours and during holidays.

5. How the team works during an incident

The lead declares the incident and calls the team together.
The log keeper starts a log: time, what we see, what we decide and who does what.
IT takes affected systems off the network. Don't switch them off and don't wipe anything, so the evidence is kept.
We call the incident response firm and the insurer.
Legal and privacy checks whether we need to report anything. A data breach goes to the Dutch DPA within 72 hours. Under the Dutch Cybersecurity Act, an early warning goes to the NCSC within 24 hours.
Communication writes a message for colleagues, and then one for customers.
We catch up at fixed times, e.g. every 2 hours, until the incident is under control.
Look after each other. Take turns, eat and sleep, because an incident can last for days.

6. Arrange beforehand

There is a list of our most important systems and data, and who administers them.
Logging of logins and systems is switched on and we keep the logs for a while. That way you can see afterwards what happened.
There is a backup an attacker cannot reach (offline or immutable), and we have tested that restoring it works.
Admin accounts have MFA and are separate from the accounts used for daily work.
Staff know where to report a suspicious email or strange message.
A standard message for customers and the press is ready.

7. Practise and improve

Last exerciseScenario for the next exercise

We practise at least once a year with a tabletop exercise, e.g. 'we have ransomware' or 'an employee logged in on a fake site'.
After every incident or exercise we discuss within 2 weeks what went well and what can be better.
We update this plan when people, suppliers or systems change.