ISO27001 Compliant Incident Response Plan Generator

Generate a comprehensive, audit-ready incident response plan aligned with ISO27001 Annex A.16 and industry best practices.

#iso27001#incident-response#cybersecurity#compliance#governance

Created by PromptLib Team

February 11, 2026

1,628

Total Copies

4.4

Average Rating

You are an elite ISO27001 Lead Implementer and cybersecurity incident response expert with 15+ years of experience building enterprise-grade security frameworks. Create a comprehensive, audit-ready **ISO27001 Information Security Incident Response Plan (IRP)** for the following organization: **ORGANIZATION CONTEXT:** - Organization Name: [ORGANIZATION_NAME] - Industry Sector: [INDUSTRY] - Organization Size: [COMPANY_SIZE] - Critical Assets/Systems: [CRITICAL_ASSETS] - Current Security Maturity Level: [SECURITY_MATURITY] - Applicable Regulations: [REGULATORY_FRAMEWORKS] - Existing IR Team Structure: [TEAM_STRUCTURE] - Geographical Scope: [GEOGRAPHIC_SCOPE] **REQUIREMENTS:** Generate a complete IRP document structured according to ISO27001:2022 Annex A.5.24-A.5.28 (Information Security Incident Management) and ISO/IEC 27035 guidelines. Include: 1. **GOVERNANCE & POLICY FRAMEWORK** - Executive summary and scope - Policy statement aligned with A.5.24 (Planning and Preparation) - Definitions of security incidents vs. events vs. breaches - Legal and regulatory notification obligations (GDPR, NIS2, etc.) 2. **INCIDENT RESPONSE TEAM (IRT) STRUCTURE** - Detailed RACI matrix for [TEAM_STRUCTURE] - Roles: Incident Commander, Technical Leads, Communications Officer, Legal Counsel, HR Liaison - Escalation paths and decision authority matrix - 24/7 contact rotation procedures 3. **INCIDENT LIFECYCLE PROCEDURES** (A.5.25-A.5.26) - **Detection & Reporting**: Monitoring sources, triage criteria, initial assessment SLAs (1 hour, 4 hour, 24 hour rules) - **Assessment & Classification**: Severity levels (P1-Critical to P4-Low), impact assessment matrix, classification criteria specific to [INDUSTRY] - **Containment**: Short-term vs. long-term containment strategies for [CRITICAL_ASSETS] - **Eradication**: Root cause analysis methodology, malware removal procedures, vulnerability remediation - **Recovery**: System restoration priorities, validation testing, return-to-production criteria - **Post-Incident**: Evidence preservation (chain of custody), forensic investigation procedures 4. **COMMUNICATION MANAGEMENT** (A.5.27) - Internal communication tree (executive briefing templates) - External stakeholder notification templates (customers, regulators, media) - Regulatory breach notification timelines based on [REGULATORY_FRAMEWORKS] - Law enforcement engagement protocols 5. **TECHNICAL PROCEDURES** - Evidence collection and forensics preservation procedures - Log retention requirements (specific to [COMPANY_SIZE] infrastructure) - Malware/ransomware specific playbooks - Insider threat response protocols - Supply chain/third-party incident coordination 6. **CONTINUOUS IMPROVEMENT** (A.5.28) - Post-Incident Review (PIR) methodology - Metrics and KPIs (MTTD, MTTR, MTTC) - Corrective action tracking - Annual testing requirements (tabletop exercises, red team validation) 7. **APPENDICES** - Incident classification decision tree - Contact directory template - Regulatory notification matrix - Forensic evidence handling checklist - Media response holding statements **FORMATTING REQUIREMENTS:** - Use professional cybersecurity documentation standards - Include [BRACKETS] for organization-specific insertions - Add implementation notes for [SECURITY_MATURITY] level - Ensure compliance with [REGULATORY_FRAMEWORKS] - Include risk-based prioritization for [CRITICAL_ASSETS] - Structure with clear version control and document classification markings **QUALITY CONSTRAINTS:** - All procedures must be actionable and specific (not generic) - Include specific timeframes for each response phase - Address human factors (stress management, decision fatigue) - Ensure GDPR Article 33/34 breach notification workflows if applicable - Include business continuity integration points Generate the complete plan now, ensuring it would pass an ISO27001 Stage 2 audit and be immediately usable by the organization's security team.

Best Use Cases

Pre-certification preparation: Organizations pursuing initial ISO27001 certification need a compliant A.16 Incident Management documented procedure to satisfy auditor requirements for 'planned and prepared' response capabilities.

Maturity assessment gap remediation: Companies with existing ad-hoc incident handling but no formal documentation can use this to standardize their IR processes to meet ISO27001:2022 A.5.24-A.5.28 control requirements.

Merger & Acquisition integration: When acquiring companies, use this template to harmonize disparate incident response procedures across the combined entity to ensure consistent ISO27001 compliance across the group.

Regulatory compliance alignment: Organizations subject to GDPR, NIS2, or sector-specific regulations can generate plans that satisfy both ISO27001 and legal breach notification requirements simultaneously.

Third-party vendor management: Creating IR plans for critical suppliers or outsourced SOC providers to ensure their incident handling meets your organization's ISO27001 certification scope requirements.

Frequently Asked Questions

Does this prompt generate a full document or just an outline?

It generates a comprehensive, implementation-ready document with specific procedures, templates, and matrices. However, you should review and customize the bracketed placeholders ([ORGANIZATION_NAME], etc.) with your specific details before using it in an audit.

Is this compliant with ISO27001:2022 or the older 2013 version?

This prompt is designed for ISO27001:2022 (Annex A.5.24-A.5.28), but it is backward compatible with 2013 (A.16.1). The 2022 version consolidated incident management controls but the core requirements remain similar.

Can I use this if I'm not ISO27001 certified yet but planning to be?

Absolutely. This is specifically designed for pre-certification preparation. The generated plan serves as the required documented procedure for Clause A.16 (Incident Management) that certification auditors will examine during Stage 2.

How do I handle the output if my organization has multiple subsidiaries?

Run the prompt separately for each major entity with different [TEAM_STRUCTURE] or [GEOGRAPHIC_SCOPE] variables, then create a master 'Group Incident Response Framework' that references the subsidiary-specific plans.