Guides
Building an incident response plan your insurer will like
What a cyber incident response plan needs for your policy to work: the hotline call, consent rules, evidence, legal deadlines and a tested first 24 hours.
A cyber incident response plan that your insurer will like is short, written down, tested, and built around the policy itself. It tells every employee who to call in the first hour, starts with the insurer's incident hotline and the breach coach, names who can authorize decisions, and keeps the evidence and the paper trail intact. The plan does not have to be long, but it has to match the conditions in your policy, because a fast response that breaks those conditions can cost you coverage for the work.
Why the plan and the policy have to match
Most cyber forms are claims-made and conditioned on prompt notice. They also usually require the insurer's consent before you hire vendors, make a payment to an extortionist or settle a claim, and many steer you to a panel of forensic firms, law firms and notification vendors. The application often asks whether you have a written plan and when you last tested it (the cyber insurance application: what underwriters ask and how to answer covers the questions). Underwriters ask because a written, practiced plan is a cheap proxy for how quickly a business will contain a loss.
A common way these claims go sideways is not lack of effort. It is a well-meaning IT contractor who starts rebuilding servers at 2 a.m. before anyone has called the carrier. The rebuild destroys the logs forensics needed, the insurer has not consented to the vendor's rate, and a dispute starts before the loss is even measured. A plan prevents that by deciding the order of operations in advance. Details of what happens after you call are in what happens when you file a cyber claim.
What NIST says a plan is for
The federal reference point is NIST Special Publication 800-61 Revision 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management, released in April 2025 and replacing the 2012 Revision 2. It organizes incident response around the six functions of NIST's Cybersecurity Framework 2.0: Govern, Identify and Protect (the preparation work that also supports response), then Detect, Respond and Recover (the incident itself). It treats lessons learned as continuous improvement that feeds back into every function. It also recommends synchronizing business continuity plans with incident response plans, and it lists legal, public affairs and technology staff among the people involved. A 25-person business does not need a 60-page document, but the same pieces apply at small scale.
What goes in the plan
| Element | What to write | Why the insurer cares |
|---|---|---|
| Hotline and policy details | The carrier's 24-hour incident number, policy number, broker contact, and the notice address from the policy | Late or misdirected notice is the most avoidable claim dispute |
| Decision authority | Who can order systems offline, spend money, and speak for the company, with backups named | Consent and cost control; the carrier needs one voice |
| Vendor rules | Panel firms to call first; whether your existing IT or security provider is approved; who signs engagement letters | Unapproved vendors and rates are the usual reimbursement fight |
| Out-of-band communication | Phone numbers, a personal-device or alternate messaging channel, a printed contact sheet | Email and chat may be in the attacker's hands |
| Evidence preservation | Do not wipe, reimage or power off affected machines until forensics says so; keep logs and ransom notes | Forensics decides cause, scope and what must be reported |
| Legal direction | Counsel retained through the breach coach directs the investigation | Privilege is easier to protect when counsel engages the forensic firm for legal advice |
| Notification clocks | A table of the deadlines that apply to you | Missed deadlines create fines and claims that the policy may not cover |
| Extortion and law enforcement | No payment or negotiation without the carrier, counsel and a sanctions check | See paying a ransom: sanctions risk and reporting rules |
| Restoration priorities | Systems ranked by revenue impact, with backup locations | Drives cyber business interruption and dependent system failure mitigation and proof of loss |
| Cost log | Hour-by-hour timeline; invoices; internal overtime | Your claim is only as good as your documentation |
A word on privilege. In the Capital One breach litigation, a federal court in 2020 ordered production of a Mandiant forensic report after finding the work was not shown to be done because of anticipated litigation, in part because the firm already worked for the bank under a pre-breach agreement (see Hunton's summary). Courts have gone both ways on similar facts. The practical lesson is to let counsel, ideally through the policy's breach coach, retain the forensic firm under a separate engagement for the incident, and to ask your attorney how to structure it.
The clocks that start running
The plan should list every deadline that applies to your business, because they run at the same time and the policy only pays for what is lawful and timely. A short sample, each tied to its source:
| Rule | Who it covers | Deadline |
|---|---|---|
| HIPAA breach notification, 45 CFR 164.404 | Covered entities | Individuals notified without unreasonable delay and no later than 60 calendar days after discovery |
| FTC Safeguards Rule, 16 CFR 314.4(j) | Non-bank financial institutions under FTC jurisdiction (tax preparers, auto dealers and mortgage brokers, for example) | Notify the FTC as soon as possible and within 30 days of discovering an event involving 500 or more consumers |
| SEC Form 8-K Item 1.05 | Public companies | Four business days after determining an incident is material (The SEC's cyber incident disclosure rules) |
| State breach laws | Any business holding residents' personal data | Vary by state; see data breach notification laws and what they cost |
| Customer contracts | Vendors and service providers | Often shorter than statutes; read your master agreements |
The Safeguards Rule also requires covered businesses to keep a written incident response plan that addresses goals, internal processes, roles and decision authority, communications, remediation, documentation and revision after an event. A business in scope has a legal reason to write the plan, not only an insurance one.
On the federal side, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) will eventually require covered critical infrastructure entities to report covered incidents within 72 hours and ransom payments within 24 hours. As of CISA's page in 2026, the final rule had not been issued, so there is no CIRCIA deadline to plan around yet. Check CISA's CIRCIA page at renewal. Reporting a crime to the FBI through IC3 is voluntary for most businesses, but write down who decides and when, and coordinate it with counsel and the carrier.
The first 24 hours, in order
This is the sequence a good plan hard-wires. Adjust it to your policy.
- Confirm and contain. Isolate affected devices from the network (unplug, do not shut down or wipe) and disable suspected accounts. Do not delete anything.
- Call the carrier hotline and the breach coach. Do this before hiring anyone. Give the policy number and the facts you know. Some carriers, Coalition for one, say on their claims page that policyholders can ask for triage help before a formal claim.
- Move to a clean communication channel. Use phones or a platform the attackers cannot reach.
- Let counsel engage forensics under the policy's panel or an approved firm.
- Preserve. Image affected systems, collect logs and keep the ransom note and any attacker messages.
- Start the log. Record times, who did what, and costs.
- Check the clocks. Counsel decides which notices are triggered and by when.
- Decide on restoration. Compare backup integrity against the forensic findings before restoring, or you may restore the attacker's access.
- Hold the line on payments. No ransom negotiation or payment without the carrier and counsel.
Test it, then fix the gaps
A plan is only worth the last time someone used it. A tabletop exercise takes two hours: pick a scenario such as ransomware hitting the accounting system on a Friday afternoon, read the plan aloud and have each person say what they would do. Expect to find that the hotline number is not on anyone's phone, the backup administrator is on vacation, and nobody knows who may approve a vendor invoice. NIST's guidance treats exercises as a way to find improvements, and underwriters ask about them. Review the plan after any real incident, any change in IT provider, and at each renewal. Pair it with the controls carriers want in MFA, EDR and backups: the controls cyber insurers now require, such as multi-factor authentication and tested backups, because the plan cannot compensate for them.
A hypothetical: the 40-person distributor
Say a 40-person distributor in Ohio discovers on a Monday morning that its order system is encrypted. This is an illustration, not a typical claim. With a plan, the operations manager opens the contact sheet, calls the carrier hotline, and the breach coach hires forensics the same morning. The IT contractor is told to preserve, not rebuild. The coach confirms no regulated personal data was taken, which narrows the notification analysis. Without a plan, the owner calls the IT contractor first, the contractor restores from a backup that was itself encrypted, and the company spends two days chasing the carrier for consent to costs it has already incurred. The first scenario is not free of cost. It is simply organized, and the difference shows up in the proof of loss.
Key takeaways
- Write the plan around your policy: carrier hotline first, consent before spending, panel vendors, and written notice details.
- Preserve evidence and let counsel direct forensics. Reimaging machines before the investigation can cost you the answer to "how did they get in?"
- List the deadlines that apply to you, from HIPAA's 60 days to FTC Safeguards' 30 days and customer contract clocks.
- Test the plan with a tabletop at least yearly and keep contacts off the systems that can be compromised.
- Use the cyber insurance readiness checklist to confirm the plan, the controls and the contacts line up before renewal.