Incident Response Plan Template for Houston Businesses: Build Yours in One Day

Define who does what during an incident. Every role needs a primary and a backup contact.

Critical: Print this contact list and store a physical copy in a secure location (office safe, incident commander's home). During a ransomware attack, your email, Teams, and shared drives may be inaccessible — digital-only contact lists are useless when you need them most.

Not every alert is a full incident. Define severity levels so your team responds proportionally:

Ransomware Containment (SEV 1)

1. Isolate affected systems immediately — disconnect from network (pull Ethernet, disable WiFi). Do NOT power off (preserves volatile memory for forensics).
2. Disable compromised accounts in Active Directory and Entra ID. Revoke all sessions.
3. Block lateral movement — isolate affected network segments at the switch/firewall level.
4. Preserve evidence — do not reimage or wipe until forensic imaging is complete.
5. Contact MSP/IR firm using the emergency number. Do not attempt DIY forensics.
6. Contact cyber insurance carrier — most policies require notification within 24-72 hours and pre-authorization before ransom payment.

BEC/Wire Fraud Containment (SEV 1)

1. Contact your bank immediately — request wire recall. First 24 hours are critical.
2. File IC3 complaint at ic3.gov — FBI's Recovery Asset Team has recovered hundreds of millions.
3. Reset compromised email account — password, MFA, and revoke all sessions.
4. Check inbox rules — remove any forwarding rules, delete rules, or folder-move rules the attacker created.
5. Notify affected parties — clients or vendors whose data may have been exposed through the compromised inbox.

Internal Communication (All-Staff)

"We are investigating a security incident affecting [specific systems]. [Specific instructions — do not open email / do not log in / work from personal devices]. Updates will be provided every [2 hours / end of day]. Direct questions to [Communications Lead name and phone]."

Client Communication

"We are aware of a security incident affecting our systems. We have engaged cybersecurity experts and are working to resolve the situation. Your data [is / may be] affected. We will provide a detailed update within [24/48 hours] with specific information about any impact to your account."

Within 2 weeks of incident closure, conduct a post-incident review:

• What happened? (root cause, attack vector, timeline)
• What worked in our response? (keep doing)
• What didn't work? (fix before next incident)
• What controls would have prevented this?
• Update the IRP based on lessons learned
• Schedule remediation for identified gaps

A plan that hasn't been tested will fail under pressure. Run a tabletop exercise quarterly — gather your IR team, present a scenario ("It's 7 AM Monday and your controller just reported a $180,000 wire transfer to an unknown account"), and walk through every decision. You'll find gaps in the plan every time.

Need help building or testing your IR plan? LayerLogix develops incident response plans for Houston businesses and conducts tabletop exercises against realistic scenarios. Call 713-571-2390.

Related: Incident Response Services | Threat Remediation | Business Continuity Plan Guide | Cyber Insurance Guide