Habit 14 of 18
When things go wrong
A written incident plan
You have written down who does what when something goes wrong.
In an incident, people lose time working out who does what. A written plan saves those hours.
Switch it on in the map Counts towards 8 articles, controls and categories
If something has gone wrong now, the incident clock shows who to tell and by when.Open the incident clock
§1 How to do it
How a small firm does it
- Write one or two pages: who leads, who to call, and the first steps for common cases like ransomware or a lost device.
- Include your IT supplier's and insurer's contact details.
- Say how you will keep a record of what happened and what you did.
- Walk through it once a year with the people named in it.
Evidence that shows it
- The plan, with a version and review date
- Notes from the last walk-through
Ireland: NCSC Ireland guidance on incident response applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 1 item
-
21(2)(b) Incident handling · supports
incident handling
Incident handling is named in this measure.
Read Art 21(2)(b) on EUR-Lex
General Data Protection Regulation 1 item
-
Art 33 Telling the DPC about a breach within 72 hours · supports
The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.
Article 33(5) asks you to document every personal data breach, its effects and what you did. A plan makes sure that happens.
Read Art 33(5) on EUR-Lex
ISO/IEC 27001:2022 2 items
-
A.5.24 Getting ready for incidents · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control is about planning and preparing for incidents, including roles.
About ISO/IEC 27001:2022 on ISO -
A.5.26 Responding to incidents · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
A written plan sets out how you will respond.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 4 items
-
ID.IM Improvement · subset
ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
Having a written incident response plan, and keeping it up to date, is this outcome.
Read ID.IM-04 on NIST -
RS.MA Incident management · supports
RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared
This category is about running the plan once an incident is declared. Having the plan comes first.
Read RS.MA-01 on NIST -
RS.AN Incident analysis · supports
RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident
A good plan says who works out what happened and why.
Read RS.AN-03 on NIST -
RS.MI Incident mitigation · supports
RS.MI-01: Incidents are contained
RS.MI-02: Incidents are eradicated
A good plan says how to contain the damage and clear it up.
Read RS.MI-01, RS.MI-02 on NIST
§3 Questions it answers
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.