Incident Response Policy
Generate an Incident Response Plan with roles, severity tiers, and breach-notification timelines mapped to your stack — the runbook enterprise security reviews expect (mapped to CC7.4).
What's in the policy
Defines how security incidents are detected, triaged, contained, eradicated, and reported.
What the document actually says
These are the standing requirements every generated copy of the document is written from — the clause text itself, not a description of it. The document you receive is drafted on top of them: it expands on them and fills the current-state detail from your intake, and the generator is instructed to keep them, to state them fully, and never to claim a certification or invent a fact you did not supply.
Event, incident, breach
Severity and response targets
Containment through the post-incident review
Filled in for a real stack
Incident response owner: To be confirmed. … Detection / monitoring tooling: To be confirmed.
Incident response owner: the VP of Engineering, with the security on-call rotation acting as first responder. Detection / monitoring tooling: Datadog monitors on authentication failures and IAM policy changes, AWS GuardDuty and CloudTrail across both production accounts, alerting into PagerDuty and mirrored to the #sec-incident channel.
What the auditor asks for alongside it
Where these documents go stale
An incident response policy decays through its contact list first. The on-call rotation changes, the named incident response owner leaves, a channel is renamed, the paging tool is swapped — and none of that shows up as an edit to the document. Then the architecture moves underneath it: a new data store, a new subprocessor, a new region, each one changing who has to be told and under whose contract. The document still reads correctly and is quietly unusable. What re-validates it is running it. A tabletop against a real scenario finds the dead phone number and the escalation path that now routes to nobody, and it produces the dated artifact an auditor asks for at the same time. Regenerate it when the owner, the tooling, or the data map change; exercise it on a schedule regardless.
Tell us about your stack
Answer a short intake — cloud, data types, tools. No agents to install.
We generate a tailored draft
Not a blank template: a document written for your environment and pre-mapped to controls.
Review, edit, and share
Export it or attach it straight to an enterprise security review or questionnaire.
Incident Response Policy, answered
Is an incident response plan the same as a policy?
The policy states the standing requirement; the plan is the runbook someone follows while an incident is live. Auditors generally accept them as one document as long as it carries both — the obligation, and the definitions, severity tiers, response lifecycle, and named owner. Pentest Today generates them together, so you are not maintaining two files that disagree.
What has to be in an incident response plan?
A usable incident response plan carries severity tiers that genuinely differ, one known reporting channel, definitions separating an event from an incident from a breach, containment through recovery steps, notification obligations, and a post-incident review requirement. A plan whose only instruction is to notify the security team is what reviewers reject: nothing tells a responder what to do first.
How often should it be tested?
At least annually, and a tabletop exercise is the usual form — walk a scenario through the severity tiers and the response lifecycle with the people named in the document, and write down what broke. The policy is reviewed and approved at least annually and after any material change; the exercise record is what an auditor samples.
How quickly does a breach have to be reported?
GDPR sets 72 hours from awareness for notifying a supervisory authority; HIPAA, PCI DSS, and most enterprise contracts each set their own clock, and the contract is often the tightest. The generated policy commits you to notifying without undue delay under those timelines, and to engaging legal counsel on any breach involving personal data.
Who is in charge during an incident?
A named incident response owner, recorded in the document and answered from your intake, receives every report; the identification step then assigns a lead for that specific incident. The roles table separates who maintains the policy, who operates the controls, and what everyone else owes — which is to report promptly, without penalty.
Does SOC 2 require an incident response plan?
Yes, in substance. CC7.3 through CC7.5 cover judging whether an event is an incident, working it through a defined process, and recovering afterwards, and an auditor asks for the written document plus evidence you have used it. The generated document is mapped to SOC 2 CC7.4 and ISO 27001 A.5.24 in the policy pack.
How does Pentest Today generate the policy?
Answer a short intake about your stack and we generate a tailored draft — not a blank template — pre-mapped to the controls your framework requires. You review, edit, and export it.
Can I edit the generated policy?
Yes. Every document is a starting draft you can edit, brand, and export. It's written to be review-ready but stays fully under your control.
Start your Pentest
Our agent swarm and human experts test your endpoints and deliver an audit, fast.
More from the policy library
Generate your full security policy pack.
Get the incident response policy plus everything else an enterprise security review asks for — generated from your real environment.