[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-352924-105":53,"doc-detail-352924-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","cyber-incident-response-plan-template-policy-document","Cyber-Incident-Response-Plan-Template - Policy Document","","Cyber Incident Response Plan Policy Document establishes organisation-wide procedures for handling suspected or confirmed cyber security incidents. It covers incident scope across ransomware, malware, phishing, business email compromise, unauthorised access, data breaches, denial of service, insider threats, supply chain compromises, and device loss. The plan defines severity levels P1 to P4 with specific response times, assigns incident response roles, and details six response phases from detection through post-incident review, reporting, and regulatory notification under the Privacy Act 2020.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":36,"@type":70,"position":76},"https://docshare.wps.com/template/forms/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/cyber-incident-response-plan-template-policy-document/352924/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/cyber-incident-response-plan-template-policy-document/352924.png","ImageObject",442,249,{"name":88,"@type":89},"Jacob","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-19","2026-09-22",true,{"@type":98,"interactionType":99,"userInteractionCount":79},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What is the purpose of this Cyber Incident Response Plan?","Question",{"text":108,"@type":109},"It sets out procedures the organisation follows when a cyber security incident occurs or is suspected. Objectives include quick detection and confirmation, containment and eradication, restoring normal operations, preserving evidence, meeting Privacy Act 2020 obligations, and improving security posture through learning.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How are incidents classified and what response times apply?",{"text":113,"@type":109},"Incidents are classified as P1 to P4, where P1 covers critical cases like active ransomware or complete outage with an immediate response within 1 hour, and P4 covers low-severity issues such as policy violations or unsuccessful attacks with a response within 5 business days.",{"name":115,"@type":106,"acceptedAnswer":116},"What should staff do immediately during Phase 1—Detection and Reporting?",{"text":117,"@type":109},"Stop using the affected system immediately without attempting to fix it, do not turn off the device unless instructed to preserve evidence, record time and observations, contact the IT manager or IT provider right away using the phone number, and avoid discussing the incident on potentially compromised email or messaging systems.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},352924,1791416118,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":35,"category_name":36,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":79,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":47,"language":135,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":61,"update_tm":139,"read_time":73},962084931830,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","POLICY DOCUMENT  \nCyber Incident  \nResponse Plan  \nOrganisation: [Organisation Name]  \nVersion: 1.0  \nEffective Date: [Date]  \nReview Date: [Date + 12 months]  \nPolicy Owner: [Name / Role] Prepared by [IT Provider Name]  \nIMPORTANT—KEEP ACCESSIBLE OFFLINE  \nThis document contains sensitive information about the organisation's security response procedures. A printed copy must be held by the Incident Commander and stored in a location accessible if IT systems are unavailable.  \n\n| 1. Purpose\u003Cbr>This Cyber Incident Response Plan establishes the procedures [Organisation Name] will follow when a cyber security incident occurs or is suspected. Its objectives are to detect and confirm incidents quickly, contain and eradicate their cause, restore normal operations, meet obligations under the Privacy Act 2020, preserve evidence, and learn from incidents to improve the organisation's security posture. |\n| --- |\n| 2. Scope\u003Cbr>This Plan applies to all cyber security incidents including ransomware and malware, phishing and business email compromise, unauthorised access to systems or data, data breaches involving personal information, denial of service attacks, insider threats, supply chain compromises, and loss or theft of devices containing organisational data. |\n| 3. Incident Severity Classification |\n\n\n| Level | Classification | Description | Response Time |\n| --- | --- | --- | --- |\n| P1 | Critical | Active ransomware, confirmed data breach, complete system outage, active intrusion | Immediate—within 1 hour |\n| P2 | High | Suspected breach, significant malware, compromised admin credentials, major disruption | Within 4 hours |\n| P3 | Medium | Phishing email clicked, single device infected, suspicious activity, minor data exposure | Within 24 hours |\n| P4 | Low | Policy violation, unsuccessful attack, lost device with no data | Within 5 business days |\n\n4. Incident Response Team  \n\n| Role | Name | Mobile | Alternate |\n| --- | --- | --- | --- |\n| Incident Commander | [Name] | [Mobile] | [Alternate] |\n| IT Lead—[IT Provider Name] | [Name] | [IT Provider Phone] | [Alternate] |\n| Communications Lead | [Name] | [Mobile] | [Alternate] |\n| Privacy Officer / Legal | [Name] | [Mobile] | [Alternate] |\n| Senior Management | [Name] | [Mobile] | [Alternate] |\n\n5. Response Phases  \nPhase 1—Detection and Reporting  \n1. Stop using the affected system immediately—do not attempt to fix the issue yourself  \n2. Do not turn off the device unless instructed—powered systems preserve evidence  \n3. Note the time, what you observed, and any actions taken before reporting  \n4. Contact [IT Manager / IT Provider] immediately on [IT Provider Phone]  \n5. Do not discuss the incident on email or messaging systems that may be compromised—use phone  \nAFTER HOURS INCIDENTS  \nFor P1 or P2 incidents outside business hours, contact [IT Provider Name] on [IT Provider Phone] .  \nDo not wait until the next business day to report a suspected ransomware infection or active breach.  \nPhase 2—Assessment and Classification  \nThe IT Lead will assess the incident and assign a P1 to P4 severity classification, determining the nature and scope of the incident, which systems and data are affected, whether personal information has been compromised, whether the incident is ongoing, and whether external assistance is required.  \nPhase 3—Containment  \nContainment actions may include isolating affected devices from the network, blocking compromised user accounts, taking affected systems offline, blocking malicious IP addresses or domains at the firewall, and suspending access for third-party providers whose systems may be involved.  \nPhase 4—Eradication  \nThe cause of the incident must be identified and removed. Malware must be removed from all affected systems, compromised credentials revoked and replaced, vulnerabilities remediated, and affected systems scanned and verified clean before restoration.  \nPhase 5—Recovery  \nSystems will be restored from clean verified backups, in priority order","cbCaimFrtCRXVyTk","https://ap.wps.com/l/cbCaimFrtCRXVyTk","pdf",103973,"English","# 1. Purpose\n# 2. Scope\n# 3. Incident Severity Classification\n# 4. Incident Response Team\n# 5. Response Phases\n# 6. Communication\n# 7. Ransomware—Specific Guidance","[{\"question\":\"What is the purpose of this Cyber Incident Response Plan?\",\"answer\":\"It sets out procedures the organisation follows when a cyber security incident occurs or is suspected. Objectives include quick detection and confirmation, containment and eradication, restoring normal operations, preserving evidence, meeting Privacy Act 2020 obligations, and improving security posture through learning.\"},{\"question\":\"How are incidents classified and what response times apply?\",\"answer\":\"Incidents are classified as P1 to P4, where P1 covers critical cases like active ransomware or complete outage with an immediate response within 1 hour, and P4 covers low-severity issues such as policy violations or unsuccessful attacks with a response within 5 business days.\"},{\"question\":\"What should staff do immediately during Phase 1—Detection and Reporting?\",\"answer\":\"Stop using the affected system immediately without attempting to fix it, do not turn off the device unless instructed to preserve evidence, record time and observations, contact the IT manager or IT provider right away using the phone number, and avoid discussing the incident on potentially compromised email or messaging systems.\"}]","Cyber-Incident-Response-Plan-Template - Policy Document | PDF",1790102010]