Incident Response Plan Template: What to Document Before CIRCIA Reporting Starts

Short answer: A useful Incident Response Plan (IRP) template names who decides an event is reportable, who sends the report, what it contains and how fast. With the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), critical infrastructure organizations should confirm their plan supports a 72-hour incident report and a 24-hour ransom payment report.

What should an incident response plan template include?

Most templates cover detection, containment and recovery but skip the decisions that create regulatory exposure. A plan that holds up to a regulator or assessor documents:

• Scope and roles: the incident response team, the incident commander and named backups for nights and weekends.
• Severity criteria: how an event becomes an incident, and how an incident becomes a reportable incident.
• Reporting decision authority: who makes the "reportable or not" call, and the evidence that supports it.
• Reporting matrix: each obligation, its clock, its recipient and its submission method.
• Evidence handling: what to preserve, how and for how long.
• Communications: internal escalation, customers, prime contractors, insurers and law enforcement.
• Testing and review: tabletop exercise frequency and the owner of plan updates.

The issue with CIRCIA is that this can also create dual-reporting requirements for organizations that are required to comply with DFARS for Controlled Unclassified Information (CUI) since these are different reporting structures.

Which reporting clocks does your plan need to support?

Many organizations answer to more than one clock. Use the list below as a starting point for your reporting matrix, not as legal advice.

• CIRCIA covered cyber incident report: Applies to covered critical infrastructure entities. Clock: 72 hours after reasonable belief. Owning document: incident response procedures and reporting matrix.
• CIRCIA ransom payment report: Applies to covered critical infrastructure entities. Clock: 24 hours after payment. Owning document: incident response procedures and the executive approval workflow.
• DFARS 252.204-7012 cyber incident report: Applies to defense contractors handling covered defense information. Clock: 72 hours after discovery. Owning document: the incident response plan referenced in the System Security Plan (SSP).
• SEC Form 8-K Item 1.05: Applies to public companies, for material incidents. Clock: 4 business days after the materiality determination. Owning document: the materiality determination procedure.

Where the same incident triggers several clocks, the plan should name one owner who tracks all of them. Note - the CIRCIA statute also allows for avoiding duplicate reporting where a substantially similar report goes to another federal agency under an agreement with CISA.

How does a plan fit with policies, standards and procedures?

An IRP sits in the middle of the documentation stack. The policy states management intent ("we report incidents as required by law and contract"). The standard sets the measurable requirement ("reportable incidents are reported within the shortest applicable deadline"). The procedures and the plan describe who does what, step by step.

The Hierarchical Cybersecurity Governance Framework explains this structure. Keeping the layers separate means a new reporting rule changes one standard and a few procedure steps, not your whole policy set.

Template or program: what are you actually buying?

A one-page plan template can satisfy a checkbox. It rarely survives a real incident or an assessment, because it skips severity criteria, decision authority and evidence handling. ComplianceForge's Integrated Incident Response Program (IIRP) is editable program-level documentation based on NIST SP 800-61 guidance, covering how incident response is managed, including forensics and reporting. It scales from a small business to a large enterprise.

If you also need continuity documentation, see the incident response and business continuity templates. If your controls are managed in the Secure Controls Framework (SCF), map your reporting procedures to the SCF incident response domain so one procedure set supports several frameworks.

A 30-minute readiness check

1. Open your current plan and search for "report". Is there a reporting matrix with clocks and recipients?
2. Find the name of the person who decides whether an incident is reportable. Is a backup named?
3. Confirm that your plan says how evidence is preserved during the first 72 hours.
4. Check the date of your last tabletop exercise and whether a reporting decision was part of it.

This is where performing at least an annual tabletop exercise to validate the viability of incident response capabilities is a necessity. People, Processes, Technologies, Data and Facilities (PPDTF) change, so it is important to keep the IRP accurate to current business operations.

Frequently Asked Questions (FAQ)

What is CIRCIA?

CIRCIA is the Cyber Incident Reporting for Critical Infrastructure Act of 2022. It directs CISA to issue rules requiring covered critical infrastructure entities to report covered cyber incidents within 72 hours and ransom payments within 24 hours.

Is an incident response plan the same as an incident response policy?

No. A policy states management intent and authority. A plan and its procedures describe roles, decisions and steps. Assessors usually expect both, plus evidence that the plan was tested.

How often should an incident response plan be tested?

At least annually is a common expectation, and after significant changes such as a new reporting rule, a merger or a major system change. Your contracts or framework may set a specific frequency.

Can one incident response plan cover several reporting obligations?

Yes. Use one plan with a reporting matrix that lists each obligation, its clock and its recipient, and assign one owner to track every clock during an incident.