Cyber insurance guide
Building a cyber incident response plan
An incident response plan turns a chaotic event into a set of steps. It also helps you meet policy conditions.
Plan outline
- Contacts: insurer incident hotline, policy number, breach coach, IT provider, bank fraud department, and leadership
- Detection and triage: who decides an incident is real and how it is escalated
- Containment: isolating systems without destroying evidence
- Notice to the insurer before engaging outside vendors
- Investigation led by forensics under the direction of counsel
- Notification decisions under applicable state laws
- Recovery from tested backups
- Lessons learned and control improvements
Wire fraud is a race
If money was sent to a criminal, call your bank immediately and file a complaint at ic3.gov. Fast action improves the chance of freezing funds.
Keep it offline too
Store a printed copy of the plan and contact list. If ransomware encrypts your network, the digital copy may be unavailable.
See first-party coverage for what your policy pays during a response.
Frequently asked questions
Who should be on the response team?
An incident lead, IT or your managed service provider, a senior decision maker, and outside contacts such as your insurer's hotline and a breach coach.
Should we call law enforcement?
Reporting to the FBI through IC3 or a local field office is generally encouraged, especially for wire fraud, where quick reports can help recover funds.
How often should we test the plan?
At least once a year through a tabletop exercise, and after major system changes.
More coverage and guides
- First-party cyber coverage
- Third-party cyber liability
- Ransomware and cyber extortion coverage
- Social engineering and funds transfer fraud
- Cyber business interruption
- Regulatory defense and PCI coverage
- Data breach notification laws by state
- Security controls cyber insurers look for
- Cyber insurance application checklist
- What affects cyber insurance cost
- Building a cyber incident response plan
Last updated October 15, 2026 · How we research