How to write an incident response plan carriers accept

Of the seven controls carriers require, the incident response plan is the one most often missing entirely, not because it's hard but because it's homework nobody owns. It's also the requirement with the best effort-to-outcome ratio: one honest afternoon with the right structure turns a hard "no" on your application into a documented "yes."

Here's the structure that satisfies the question, section by section.

What must the plan actually contain?

1. Roles, by name. Who declares an incident. Who talks to the carrier. Who talks to staff and customers (one voice, not five). Who can authorize spending money at midnight. Small businesses double-hat these roles; that's fine. Names and cell numbers, not titles.

2. The call list. Your cyber carrier's 24/7 hotline and policy number at the top. Most policies require prompt notice, and carriers keep approved forensics firms and breach counsel on call. Then: IT/MSP, backup provider, bank (for fraud holds), key vendors, and after-hours numbers for all of the above.

3. First-hour isolation steps. Written for whoever is standing there, not for a security engineer: disconnect the affected machine from network/Wi-Fi (don't power it off; evidence lives in memory), disable the compromised account, preserve what's on screen with a phone photo, start a timeline note. Plain, numbered, laminated-card simple.

4. Backup recovery basics. Where backups live, who has credentials, the restore order (what comes back first), and, the question every tabletop exposes, whether anyone has actually restored from them recently. Claims data is blunt on why this matters: a record 86% of ransomware victims refused to pay in Coalition's 2026 analysis, and it's working backups plus a rehearsed plan that turn refusal from a wish into an option.

5. Communication rules. When and how you notify staff, affected customers, and regulators. You don't need the statutes memorized. You need "call counsel before any external statement" written down, because notification deadlines start at discovery and improvised statements create liability.

6. The severity ladder. A weird email attachment is not the same as encrypted servers. Three tiers (nuisance / serious / crisis) with who gets woken up at each keeps small events small.

Why "tested" matters as much as "written"

Applications increasingly ask both questions: Do you have a written IR plan? and Has it been tested in the last 12 months? Underwriters learned that untested plans are shelfware, and tabletops prove it every time. In the first exercise, some phone number is always dead, some "who decides this?" is always unanswered, and someone always asks where the backups actually are.

The test that counts is modest: 60–90 minutes, one scenario, dated notes. Walk the room through a ransomware morning step by step. Write down what broke. Fix those things. That dated page of notes is your honest "yes" to the testing question, and your evidence if a claim is ever disputed.

The call order almost everyone gets wrong

Here is the part that costs people money, and it belongs in the plan rather than in someone's memory.

The instinct when ransomware appears is to call whoever handles your IT and tell them to fix it. That instinct can cost you the claim. Cyber policies commonly require you to notify the carrier before engaging forensics, legal or negotiation help, and many pay only for vendors on their own panel. An IT provider who starts reimaging machines on Monday morning is also destroying the evidence a forensics firm needs to establish what happened and what was taken.

So the order in your plan reads: contain, then notify the carrier's hotline, then engage help through them. Containment means disconnecting affected machines from the network, not wiping them. Powering a machine off can lose memory evidence too, so the plan should say isolate rather than shut down.

Put the carrier's 24-hour hotline number, your policy number and your broker's mobile in the plan itself, printed, not only in a cloud document you may not be able to open. Read your own policy's notification clause while you write this section, because the window and the vendor rules differ, and the version in your plan should match the policy you actually hold.

The fastest honest path

If you have nothing today: write the one-page version this week (roles, call list, isolation steps, backup location), then grow it into the full plan with a proper template. The Surable Readiness Pack includes a fill-in-the-blank IR plan mapped to the exact application questions, plus the tabletop script and note-taking sheet. The whole exercise is designed to fit in one afternoon and one meeting.

Or start further upstream: the free Readiness Check will tell you in five minutes whether the IR plan is your biggest gap or merely one of several.