Most small businesses discover they need an incident response plan at the worst possible moment: during an incident. The plan gets written in hindsight, under stress, and is usually wrong because it's built from one event instead of a pattern.
Here's the incident response plan template that works for teams of 1-10 people. It fits on two pages, takes 30 minutes to fill in, and has been tested against real outages, security incidents, and the 2am panic that comes with both.
The Five Phases (And How Long Each Should Take)
Phase 1: Detect (Target: under 15 minutes)
The first phase isn't about fixing anything. It's about noticing that something is wrong and saying it out loud.
- Detection source: monitoring alert, customer report, or someone noticing something is off
- First action: acknowledge the alert (stop the pager from screaming)
- Declaration: one person says "I'm declaring an incident: [what we see], [when we first saw it]. I'm running this until someone takes over."
- Channel: create or open the incident channel (#incident-YYYY-MM-DD)
The 15-minute target is generous. Most small teams take 30+ minutes because nobody wants to be the person who declares an incident. Practice declaring. False alarms are cheap; silence is expensive.
Phase 2: Triage (Target: under 15 minutes)
Triage answers three questions, in order:
- How bad is it? (severity: S0 = revenue stopped or data at risk, S1 = major feature broken, S2 = degraded but functional, S3 = cosmetic)
- How big is it? (one user, one team, all users, all systems?)
- What changed? (check the deploy log, config changes, vendor status page, recent commits)
Write the answers in the incident channel. One line each. This is your triage record.
Phase 3: Mitigate (Target: under 1 hour for S0/S1)
Mitigation is not resolution. Mitigation is "stop the bleeding."
- Rollback if a recent change caused it (this is why you test rollbacks before you need them)
- Scale if it's a capacity issue (add resources, throttle traffic, shed load)
- Isolate if it's a security issue (cut network access, revoke credentials, preserve evidence)
- Communicate to affected users: "We're aware of [issue], investigating, next update at [time]."
The most common mitigation mistake: trying to fix the root cause instead of stopping the bleeding. If the site is down, get it back up first. Figure out why it went down second.
Phase 4: Resolve (Target: same day for S0/S1)
Resolution is the actual fix. By now you should understand the cause. The resolution step:
- Apply the fix in the lowest-risk way possible
- Verify it worked (run the smoke test, check the metrics, ask a user)
- Document what you did (one paragraph in the incident log)
Phase 5: Post-Mortem (Target: within 2 business days)
The post-mortem is the most skipped phase and the most valuable. It's a 30-minute meeting (not a witch hunt) that answers:
- What happened? (timeline, one sentence per event)
- Why did it happen? (root cause, not just the trigger)
- What did we learn? (what would have caught it earlier, prevented it, or made recovery faster)
- What are we changing? (one to three action items, with owners and deadlines)
The post-mortem template that works: blameless, forward-looking, and short. If it's longer than one page, it's a report, not a post-mortem.
The Template (Copy This)
INCIDENT RESPONSE PLAN — [Company Name]
SEVERITY DEFINITIONS
S0: Revenue stopped or data at risk → page everyone, update every 30 min
S1: Major feature broken → page on-call, update every hour
S2: Degraded but functional → email team, update daily
S3: Cosmetic or minor → ticket it, fix when convenient
ON-CALL ROTATION
Primary: [name, phone] — weeks 1, 3
Secondary: [name, phone] — weeks 2, 4
Escalation: [name, phone] — for S0 only
INCIDENT CHANNEL
[link to Slack/Discord/Teams channel]
DETECTION SOURCES
- Monitoring: [dashboard URL]
- Customer reports: [support channel]
- Vendor status: [list of status page URLs]
COMMUNICATION TEMPLATES
Initial: "[INCIDENT — Investigating] We are aware of [issue]. Investigating. Next update by [HH:MM]."
Update: "[INCIDENT — Update HH:MM] [status change or no change]. Next update: [HH:MM]."
Resolved: "[RESOLVED — HH:MM] [service] is operating normally. Post-mortem within 2 business days."
POST-MORTEM
Owner: [incident commander]
Deadline: [2 business days from resolution]
Template: What happened / Why / What we learned / What we're changing
The Three Things That Make This Actually Work
1. Practice before you need it. Run a tabletop exercise once a quarter. Pick a scenario (ransomware, vendor outage, data breach), walk through the plan, and time how long it takes. If it takes more than 10 minutes to get through detection and triage, the plan is too complex.
2. Pre-write your communications. The templates above exist because writing a clear incident message at 2am is nearly impossible. Copy them, fill in the blanks, and keep them in the incident channel's pinned messages.
3. Keep the plan accessible. If the plan lives in the same system that's down, you don't have a plan. Keep an offline copy — printed, in a shared note, or in a password manager — that anyone can reach when the primary systems are unreachable.
Incident Response Resources
Want the full template pack?
✅ Free Checklist (The First 30 Minutes): https://hive80lab.gumroad.com/l/first-30-minutes
📋 Ops Field Cards (12 printable incident checklists, $4): https://hive80lab.gumroad.com/l/rtodsv
🛡️ Ops Starter Kit (full incident response plan template + runbook, $19): https://hive80lab.gumroad.com/l/ops-starter-kit
📦 Mega Bundle (all 5 kits, $49): https://hive80lab.gumroad.com/l/ops-mega-bundle
These include the full incident response plan, escalation ladders, containment checklists for Linux/macOS/Windows, and five tabletop exercises.
Tags: incidentresponse, devops, operations, security
🔒 Ready to Secure Your Business Operations?
You just learned about shadow IT risks and security audits. Here's how to actually implement these protections:
🛡️ Security Starter Pack - A$19
- Shadow IT audit templates you can use today
- Security checklists for small teams
- Incident response workflows
- Get Security Starter Pack
💰 Ops Mega Bundle - A$49 (normally A$88 - 45% off)
- All 5 operations kits including Security, Automation, and more
- 34 files total, lifetime updates
- 30-day money-back guarantee
- Get the Mega Bundle
🎯 Limited Time: Save 45% with code MEGA50 (first 20 buyers)
Stop security gaps before they start. Get the tools you need tonight.
Published on DEV Community: @hive80lab | Operations templates for small teams
Top comments (0)