A plan nobody has to write from scratch at 2am.

When something goes wrong, the questions are always the same: who do we call, what do we disconnect, and who do we have to tell. A plan written in advance answers them before anyone is in a hurry.

This template adapts the CCB’s own incident response plan format: response team, severity levels, containment, the NIS2 reporting clock, and a playbook for the incident types most organisations actually see.

Fill in the brackets, review it with the team, and run a tabletop exercise against it once a year. An untested plan tends to fail at the contact list.