Why improvising fails the form
Questionnaires and insurance applications both ask whether you have an incident response plan. "We will figure it out" fails the form, because the form asked for a document. It also fails the incident, because the first hour is spent discovering who is allowed to declare one.
Clients ask for the same reason insurers do. They want to know that if their data is involved, someone at your firm already knows who calls whom. “We would call our IT vendor” is not a plan. It is a phone number.
Roles sized to the people in the room
A plan for a 30-person firm names roles that exist. Someone declares the incident and is the single internal voice. Someone talks to counsel and to the carrier. Someone handles clients, because a managing partner who hears about the incident from a client has already lost the hour. Someone technical contains and restores, whether that person is on staff or a vendor with a contract that actually obliges them to show up.
Do not invent a crisis-management committee, a war room, or a rotation of duty officers. If a role has no person, the plan should say the role is uncovered, not borrow a job title from a template. An insurer can read a short plan with four names. An insurer can also read a 40-page plan and ask which of the committees has ever met. You would rather be asked the first question.
What good enough includes
Good enough, for the firms this is written for, is a document someone can follow at 7 in the morning:
- How an incident is declared, and who is allowed to declare it.
- The first calls: counsel, carrier, the technical lead, and the person who speaks to clients.
- How you decide severity, in language a non-specialist can apply.
- How evidence is preserved before systems are rebuilt in a panic.
- How you restore, from backups you have actually tested, and who says service can resume.
- What gets written down afterward, because the after-action is the artifact the next questionnaire asks for.
A tabletop is not the paper
The paper is what the application asks you to attach. A tabletop is how you find out the paper is wrong: the named spokesperson is unavailable, the restore takes longer than the plan says, the vendor’s emergency clause is not what you thought. A facilitated tabletop, with a written after-action, is a quoted engagement. It is the artifact a carrier asks for when they want more than a PDF. Do the paper first.
Respond and Recover, not a third framework
In NIST CSF 2.0 the work sits in Respond and Recover. Respond is the declaration, the containment, the communications. Recover is the restore and the decision that you are done. Firms collapse those into one page and then discover, in the incident, that restoring was nobody’s job. The plan should make the split visible even if the same person holds both roles. One person can wear two hats. A plan cannot leave a hat on the table.
The kit, the engagement, and the credit
The Incident Response Plan Starter Kit is $349. You edit it to your names, your systems, and your carrier. It is the document you can finish this week. It is not a tabletop and it is not legal advice. If the kit is the start of a larger engagement, the purchase is credited in full toward advisory work booked within 90 days, so you are not paying twice for the same first draft.
When the client or the carrier wants the plan plus the evidence around it, policies, a questionnaire response, a ranked set of gaps, that is remediation and documentation, fixed scope, typically $3,500 to $7,500. The free readiness assessment will tell you whether response and recovery are the gap you think they are, or whether access and backups will embarrass you first. Take it before you spend the week polishing a plan for an incident your restore cannot survive.
A plan is not legal advice, and it is not a guarantee of insurance coverage, a claim payment, or a certification. Templates are a starting point. They do not replace counsel, a carrier’s panel, or a test of whether the plan works.