Free tools Windows power users keep installed
One-click scans. No signup required.
A useful cyber incident response plan tells people how to recognize and report a suspected attack, who has authority to make decisions, how to contain damage and preserve evidence, and how the organization will restore critical services and communicate. Build it around your business’s systems and risks, keep a usable copy offline, and rehearse it with the people who would have to act.
Start with current guidance, then tailor it to your organization
NIST’s current guidance is SP 800-61 Revision 3, finalized in April 2025. It supersedes Revision 2 and integrates incident response into cybersecurity risk management aligned with the NIST Cybersecurity Framework 2.0. NIST describes incident response as part of risk management across organizational operations; the publication is a risk-management profile, not a technical playbook for every system.
As an Amazon Associate I earn from qualifying purchases.
For a working plan, organize activities around preparation, detection and analysis, containment, eradication, recovery, communications, and learning after an incident. Treat these as connected activities, not a rigid sequence: responders may need to investigate while containing an attack, for example. Adapt the detail to your organization’s size, services, technology, and legal or contractual obligations.
Recommended Free Tools
Build the plan in eight steps
1. Define what counts as an incident and how to raise the alarm
Describe what staff should report, including suspicious account activity, unexpected encryption or system changes, suspected data theft, and signs of unauthorized access. Distinguish a report or suspected incident from a confirmed one, but do not require proof before escalation. State who can declare an incident, who can raise its severity, and how staff can report concerns at any time. Include a route that works if corporate email or chat is unavailable.
#1 Best Overall
2. Assign authority, roles, and alternates
Name an incident lead to coordinate decisions and a technical response lead to direct investigation and containment. Assign a business decision-maker, legal or privacy adviser, communications lead, and owners for continuity and recovery. For each role, record an alternate, decision limits, and a contact method that does not rely on systems that may be compromised.
Make explicit who can authorize disruptive actions, such as isolating a service, taking a system offline, notifying affected parties, or restoring operations. CISA advises corporate leaders to participate in incident planning and tabletop exercises, not leave the plan solely to technical staff. See CISA’s guidance for corporate leaders and CEOs.
3. Map critical services and dependencies
List the business functions that must continue or be restored first, the systems and data that support them, their owners, and important dependencies such as identity services, cloud platforms, network connections, vendors, and backups. Record any safe manual workaround and who can authorize its use. Rank restoration by business impact, dependencies, and safety rather than by which system is easiest to bring back.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match4. Write an incident workflow responders can follow
For each report, tell responders where to record it, how to assess credibility and scope, who sets severity, and when to escalate. Define who leads investigation and how findings and decisions are logged. Include response modules for the threats and environments that apply to you, such as ransomware, compromised identities, data exfiltration, cloud services, or operational technology.
Set containment authority and decision criteria in advance. CISA’s #StopRansomware Guide advises determining which systems are affected and isolating them; when many systems or network segments are involved, network-level isolation may be needed. The correct action depends on the environment and incident. The plan should identify who can make that call and who must be consulted, rather than prescribe a universal technical action.
Pair containment with evidence handling. Specify who preserves relevant logs, system images, memory, and malware or indicators when appropriate, where those materials are stored, and how access is controlled. If immediate mitigation is not feasible, CISA’s checklist advises collecting images and memory from representative affected devices where appropriate and protecting volatile evidence from loss or tampering. Use qualified incident responders when the organization lacks the necessary capability.
Rank #3
5. Plan communications and reporting
Prepare an approval path and a channel for each audience: employees, executives, customers, partners, regulators, law enforcement, and the public when a statement is needed. Include short holding-message templates and employee instructions that can be used without email or collaboration tools. Identify who approves each message and how the team will coordinate with service providers, insurers, counsel, and response agencies. CISA’s ransomware guide recommends a communications plan alongside the incident response plan.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Do not put a single reporting deadline in the plan as if it applied to every attack. Obligations depend on jurisdiction, sector, data involved, contracts, insurer terms, and the facts. Have counsel or a designated compliance owner maintain a current matrix of applicable regulator, customer, partner, insurer, and law-enforcement notification requirements. CISA’s National Cyber Incident Response Plan encourages private entities to report to appropriate federal contacts; voluntary federal reporting does not replace any legal or contractual duty. CISA’s ransomware guide flags additional considerations for personal information and electronic health information, including applicable state breach laws and relevant FTC or HHS rules; check current applicability with counsel.
6. Keep a reachable contact and resource sheet
List internal responders and alternates, relevant service providers, cyber insurer, legal counsel, law enforcement, CISA, any sector-specific agency, and contacts required by contracts. Include names or roles, out-of-band contact methods, and any information needed to reach them. Store the sheet with the plan in a form accessible if normal systems are down, and test that the contact details work.
7. Define recovery and continuity decisions
Record who authorizes restoration, how responders determine that systems and data are safe to restore, and how they validate restored services. Specify how backups are protected during an incident, what must be monitored more closely after recovery, and how the business will operate while systems remain unavailable. Tie restoration order to the critical-service map and document who owns each recovery task.
8. Exercise the plan and close the gaps
Run a tabletop scenario with leadership, technical responders, communications, legal or privacy, and business continuity owners. Choose a realistic situation, such as ransomware that affects a critical service or a compromised account followed by suspected data theft. Ask participants to work through decisions and communications using the plan rather than relying on memory.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRecord missing contacts, unclear authority, assumptions that fail, and recovery or evidence-handling gaps. Assign each issue an owner and due date, update the plan, and test changed procedures. CISA recommends exercising response and communications plans, and involving senior leadership; its corporate leadership guidance also emphasizes continuity testing.
Best Value
Choose a response model that fits your capability
These are planning choices, not mutually exclusive prescriptions. The right arrangement depends on your systems, risk, available expertise, and the decisions you need to make quickly.
| Decision | When it may fit | What to settle in the plan |
|---|---|---|
| In-house response or outside support | Use internal responders where they have the skills and availability; arrange outside incident-response support when the organization cannot investigate or respond adequately on its own. | Who can engage outside help, what access and authority it receives, and how it coordinates with internal leadership, counsel, providers, and the insurer. |
| Tabletop discussion or technical simulation | A tabletop lets participants examine decisions and communications; a technical simulation can test operational procedures where the organization can conduct it safely. | Which capabilities the exercise is meant to test, who participates, and how identified gaps are assigned and corrected. |
| Centralized command or distributed coordination | A central incident lead can coordinate organization-wide decisions; sector-specific or distributed teams may be needed where operations and responsibilities span distinct units or agencies. | Who owns the overall picture, how local or sector teams escalate, and how conflicting priorities are resolved. |
| Recovery order | Restore according to business impact, dependencies, and safety—not convenience alone. | Priority services, prerequisite systems, continuity workarounds, and the authority to approve restoration. |
Make the plan usable during a real incident
CISA’s #StopRansomware Guide, revised October 19, 2023, recommends maintaining and regularly exercising a basic incident response plan and associated communications plan. It also advises keeping hard-copy and offline versions, obtaining written executive approval, ensuring the chain of command understands the plan, and preparing notification procedures for ransomware and data-breach scenarios.
Keep the main plan concise enough to navigate under pressure, with supporting material—such as contact details, system inventories, recovery procedures, and message templates—clearly labeled and easy to find. Put a version date and owner on the document. After changes to systems, vendors, staff responsibilities, or obligations, review the affected sections and recheck the contacts and offline copies.
For an active incident, use the organization’s approved plan and seek qualified help when needed. CISA’s ransomware guidance covers isolation, evidence preservation, coordination, and recovery preparation; the appropriate operational choices still depend on the affected environment and circumstances.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
