Template · Free
A one-page incident response plan for small nonprofits
When something goes wrong, the first hour matters, and nobody thinks clearly under stress. This one-page plan decides the important things in advance. Copy it, fill in the blanks, print it, and keep a copy somewhere you can reach if your systems are down.
How to use this template
- Replace everything in [brackets] with your own details.
- Share it with leadership and anyone with admin access to your systems.
- Keep a printed copy, and a copy outside your main email and file storage. If those are compromised, you’ll still need the phone numbers.
- Review it once a year, and after any incident.
The template
[Organization name] — Security incident response plan
Last reviewed: [date] · Owner: [name, title]
1. What counts as an incident
Anything that may expose, change, or lock up our data or systems, including: a staff member clicking a suspicious link or entering a password on a fake page; a lost or stolen laptop or phone; a ransom note or files that suddenly won’t open; unexpected password-reset emails or logins; money sent because of a fake request; or a vendor telling us they were breached.
2. Who decides
Incident lead: [name, phone]. Backup: [name, phone]. The incident lead decides next steps and is the only person who speaks for us externally.
3. First steps (first hour)
1. Report it to the incident lead right away. Don’t wait to be sure.
2. If we have cyber insurance, call the insurer’s breach hotline before hiring anyone. Many policies require using their approved responders.
3. Disconnect affected devices from the network (unplug or turn off Wi-Fi), but leave them powered on.
4. Reset passwords for affected accounts from a clean device, starting with email.
5. Write down what happened, with times. Photograph ransom notes or error messages. Don’t delete suspicious emails or files.
6. Don’t pay or respond to any ransom demand without the insurer and legal counsel.
4. Who to call
IT provider: [company, phone, after-hours line]
Cyber insurer breach hotline: [phone] · Policy #: [number]
Legal counsel: [name, phone]
Bank (for fraud or wire transfers): [phone]
Security advisor: [name, email]
Report cybercrime: FBI IC3 at ic3.gov
5. Notifications
The incident lead, with legal counsel, decides whether to notify affected people, funders, partners, or regulators. Personal or health information may trigger legal notice deadlines, so involve counsel early. Board contact: [name, phone].
6. Afterward
Within two weeks: write a short summary of what happened, what we did, and what we’ll change. Update this plan.
Make it real with a 30-minute tabletop
Once the plan is filled in, gather leadership for 30 minutes and walk through a scenario: “It’s Monday morning, and our finance manager just entered her password on a fake Microsoft login page. What do we do?” You’ll quickly find the missing phone number or the unclear decision, while it’s still cheap to fix.
Need help?
A response plan and an annual tabletop exercise are part of every vCISO plan. If you’re dealing with an incident right now, go to Incident help. Otherwise, book a free intro call.
This template is general guidance, not legal advice. Notification requirements vary by state and by the type of data involved.