Security
ISO27001 Compliant Incident Response Plan Generator
Generate a comprehensive, audit-ready incident response plan aligned with ISO27001 Annex A.16 and industry best practices.
#iso27001#incident-response#cybersecurity#compliance#governance
P
Created by PromptLib Team
Published February 11, 2026
1,628 copies
4.4 rating
You are an elite ISO27001 Lead Implementer and cybersecurity incident response expert with 15+ years of experience building enterprise-grade security frameworks. Create a comprehensive, audit-ready **ISO27001 Information Security Incident Response Plan (IRP)** for the following organization: **ORGANIZATION CONTEXT:** - Organization Name: [ORGANIZATION_NAME] - Industry Sector: [INDUSTRY] - Organization Size: [COMPANY_SIZE] - Critical Assets/Systems: [CRITICAL_ASSETS] - Current Security Maturity Level: [SECURITY_MATURITY] - Applicable Regulations: [REGULATORY_FRAMEWORKS] - Existing IR Team Structure: [TEAM_STRUCTURE] - Geographical Scope: [GEOGRAPHIC_SCOPE] **REQUIREMENTS:** Generate a complete IRP document structured according to ISO27001:2022 Annex A.5.24-A.5.28 (Information Security Incident Management) and ISO/IEC 27035 guidelines. Include: 1. **GOVERNANCE & POLICY FRAMEWORK** - Executive summary and scope - Policy statement aligned with A.5.24 (Planning and Preparation) - Definitions of security incidents vs. events vs. breaches - Legal and regulatory notification obligations (GDPR, NIS2, etc.) 2. **INCIDENT RESPONSE TEAM (IRT) STRUCTURE** - Detailed RACI matrix for [TEAM_STRUCTURE] - Roles: Incident Commander, Technical Leads, Communications Officer, Legal Counsel, HR Liaison - Escalation paths and decision authority matrix - 24/7 contact rotation procedures 3. **INCIDENT LIFECYCLE PROCEDURES** (A.5.25-A.5.26) - **Detection & Reporting**: Monitoring sources, triage criteria, initial assessment SLAs (1 hour, 4 hour, 24 hour rules) - **Assessment & Classification**: Severity levels (P1-Critical to P4-Low), impact assessment matrix, classification criteria specific to [INDUSTRY] - **Containment**: Short-term vs. long-term containment strategies for [CRITICAL_ASSETS] - **Eradication**: Root cause analysis methodology, malware removal procedures, vulnerability remediation - **Recovery**: System restoration priorities, validation testing, return-to-production criteria - **Post-Incident**: Evidence preservation (chain of custody), forensic investigation procedures 4. **COMMUNICATION MANAGEMENT** (A.5.27) - Internal communication tree (executive briefing templates) - External stakeholder notification templates (customers, regulators, media) - Regulatory breach notification timelines based on [REGULATORY_FRAMEWORKS] - Law enforcement engagement protocols 5. **TECHNICAL PROCEDURES** - Evidence collection and forensics preservation procedures - Log retention requirements (specific to [COMPANY_SIZE] infrastructure) - Malware/ransomware specific playbooks - Insider threat response protocols - Supply chain/third-party incident coordination 6. **CONTINUOUS IMPROVEMENT** (A.5.28) - Post-Incident Review (PIR) methodology - Metrics and KPIs (MTTD, MTTR, MTTC) - Corrective action tracking - Annual testing requirements (tabletop exercises, red team validation) 7. **APPENDICES** - Incident classification decision tree - Contact directory template - Regulatory notification matrix - Forensic evidence handling checklist - Media response holding statements **FORMATTING REQUIREMENTS:** - Use professional cybersecurity documentation standards - Include [BRACKETS] for organization-specific insertions - Add implementation notes for [SECURITY_MATURITY] level - Ensure compliance with [REGULATORY_FRAMEWORKS] - Include risk-based prioritization for [CRITICAL_ASSETS] - Structure with clear version control and document classification markings **QUALITY CONSTRAINTS:** - All procedures must be actionable and specific (not generic) - Include specific timeframes for each response phase - Address human factors (stress management, decision fatigue) - Ensure GDPR Article 33/34 breach notification workflows if applicable - Include business continuity integration points Generate the complete plan now, ensuring it would pass an ISO27001 Stage 2 audit and be immediately usable by the organization's security team.
You are an elite ISO27001 Lead Implementer and cybersecurity incident response expert with 15+ years of experience building enterprise-grade security frameworks. Create a comprehensive, audit-ready **ISO27001 Information Security Incident Response Plan (IRP)** for the following organization: **ORGANIZATION CONTEXT:** - Organization Name: [ORGANIZATION_NAME] - Industry Sector: [INDUSTRY] - Organization Size: [COMPANY_SIZE] - Critical Assets/Systems: [CRITICAL_ASSETS] - Current Security Maturity Level: [SECURITY_MATURITY] - Applicable Regulations: [REGULATORY_FRAMEWORKS] - Existing IR Team Structure: [TEAM_STRUCTURE] - Geographical Scope: [GEOGRAPHIC_SCOPE] **REQUIREMENTS:** Generate a complete IRP document structured according to ISO27001:2022 Annex A.5.24-A.5.28 (Information Security Incident Management) and ISO/IEC 27035 guidelines. Include: 1. **GOVERNANCE & POLICY FRAMEWORK** - Executive summary and scope - Policy statement aligned with A.5.24 (Planning and Preparation) - Definitions of security incidents vs. events vs. breaches - Legal and regulatory notification obligations (GDPR, NIS2, etc.) 2. **INCIDENT RESPONSE TEAM (IRT) STRUCTURE** - Detailed RACI matrix for [TEAM_STRUCTURE] - Roles: Incident Commander, Technical Leads, Communications Officer, Legal Counsel, HR Liaison - Escalation paths and decision authority matrix - 24/7 contact rotation procedures 3. **INCIDENT LIFECYCLE PROCEDURES** (A.5.25-A.5.26) - **Detection & Reporting**: Monitoring sources, triage criteria, initial assessment SLAs (1 hour, 4 hour, 24 hour rules) - **Assessment & Classification**: Severity levels (P1-Critical to P4-Low), impact assessment matrix, classification criteria specific to [INDUSTRY] - **Containment**: Short-term vs. long-term containment strategies for [CRITICAL_ASSETS] - **Eradication**: Root cause analysis methodology, malware removal procedures, vulnerability remediation - **Recovery**: System restoration priorities, validation testing, return-to-production criteria - **Post-Incident**: Evidence preservation (chain of custody), forensic investigation procedures 4. **COMMUNICATION MANAGEMENT** (A.5.27) - Internal communication tree (executive briefing templates) - External stakeholder notification templates (customers, regulators, media) - Regulatory breach notification timelines based on [REGULATORY_FRAMEWORKS] - Law enforcement engagement protocols 5. **TECHNICAL PROCEDURES** - Evidence collection and forensics preservation procedures - Log retention requirements (specific to [COMPANY_SIZE] infrastructure) - Malware/ransomware specific playbooks - Insider threat response protocols - Supply chain/third-party incident coordination 6. **CONTINUOUS IMPROVEMENT** (A.5.28) - Post-Incident Review (PIR) methodology - Metrics and KPIs (MTTD, MTTR, MTTC) - Corrective action tracking - Annual testing requirements (tabletop exercises, red team validation) 7. **APPENDICES** - Incident classification decision tree - Contact directory template - Regulatory notification matrix - Forensic evidence handling checklist - Media response holding statements **FORMATTING REQUIREMENTS:** - Use professional cybersecurity documentation standards - Include [BRACKETS] for organization-specific insertions - Add implementation notes for [SECURITY_MATURITY] level - Ensure compliance with [REGULATORY_FRAMEWORKS] - Include risk-based prioritization for [CRITICAL_ASSETS] - Structure with clear version control and document classification markings **QUALITY CONSTRAINTS:** - All procedures must be actionable and specific (not generic) - Include specific timeframes for each response phase - Address human factors (stress management, decision fatigue) - Ensure GDPR Article 33/34 breach notification workflows if applicable - Include business continuity integration points Generate the complete plan now, ensuring it would pass an ISO27001 Stage 2 audit and be immediately usable by the organization's security team.
Best Use Cases
Pre-certification preparation: Organizations pursuing initial ISO27001 certification need a compliant A.16 Incident Management documented procedure to satisfy auditor requirements for 'planned and prepared' response capabilities.
Maturity assessment gap remediation: Companies with existing ad-hoc incident handling but no formal documentation can use this to standardize their IR processes to meet ISO27001:2022 A.5.24-A.5.28 control requirements.
Merger & Acquisition integration: When acquiring companies, use this template to harmonize disparate incident response procedures across the combined entity to ensure consistent ISO27001 compliance across the group.
Regulatory compliance alignment: Organizations subject to GDPR, NIS2, or sector-specific regulations can generate plans that satisfy both ISO27001 and legal breach notification requirements simultaneously.
Third-party vendor management: Creating IR plans for critical suppliers or outsourced SOC providers to ensure their incident handling meets your organization's ISO27001 certification scope requirements.
Frequently Asked Questions
More Like This
Back to LibraryAdvanced Multi-Platform Threat Hunting Query Generator
This prompt helps security analysts, threat hunters, and detection engineers convert vague threat scenarios and IOCs into structured, tiered query sets. It generates platform-specific syntax with performance optimization, false positive handling, and investigation playbooks to accelerate proactive threat detection.
#query-builder#threat-hunting+3
AI ISO 27001 Internal Audit Report Generator
This prompt template enables security professionals and compliance officers to rapidly produce detailed ISO 27001 internal audit reports. It structures findings by control domains, assesses compliance maturity, identifies gaps with risk ratings, and generates prioritized remediation roadmaps aligned with Annex A controls.
#iso 27001#information-security+3
AI Purple Team Scenario Creator
This prompt helps security professionals design sophisticated purple team scenarios that bridge offensive and defensive operations. It creates structured attack simulations complete with adversary tactics, defensive playbooks, and collaborative learning objectives. Use this to build tabletop exercises, live fire drills, or continuous validation programs that measurably improve security posture.
#cybersecurity#purple-team+3
Get This Prompt
FreeQuick Actions
Open in Playground
Estimated time:13 min
Verified by58 experts