Suburban Secure by Suburban Australia
Free · private · no signup

Build a cyber incident response plan your team can actually use.

When something looks wrong, speed and clear decisions matter. Fill in the essentials, preview the plan as you go, then print it or save it as a PDF. Your entries stay in this browser and are not submitted to Suburban Secure.

Most small organisations already have an incident plan.

Notice a problemCall the bossPanic

The problem starts when the boss cannot be reached, the normal systems are unavailable or nobody knows which provider, insurer or authority to contact. This builder turns that improvised response into a short, calm process designed for Australian small businesses, charities and not-for-profits.

What you will produce

  • Named incident contacts and fallback contacts.
  • Immediate actions staff can safely take.
  • Containment, assessment, notification and recovery steps.
  • Short playbooks for common incident types.
  • A clean plan to print or save as PDF.

Allow about 10–15 minutes. Review the finished plan with your IT provider, insurer and legal or privacy adviser where appropriate.

Create your plan.

Complete what you know now. A half-complete plan that names the right first call is more useful than a perfect template nobody has adapted.

1Organisation and plan owner
2Who to call
3Operating details
Private by design

This generator does not send the information you enter to Suburban Secure. It is stored only in this browser so you can return to it on this device. Export a copy to continue on another device or review it later, and store that file securely because it may contain sensitive contacts and system details. Use Reset to remove the browser copy.

Changes save in this browser.

Cyber Incident Response Plan

Your organisation

Version 1.0Reviewed: Not recorded
If you notice a possible cyber incident: stop, report it immediately and record what you observed. Do not try to investigate it alone.

Purpose, scope and application

Purpose. This plan provides a clear process to reduce harm, maintain essential operations, recover safely and improve after a cyber incident. Every incident is different; the incident lead and advisers must adapt these steps to the circumstances.

Applies to. All staff, contractors and authorised people who handle the organisation's systems or information.

Scope. All systems, devices, services and information managed by the organisation.

What may be an incident?

Unexpected logins, MFA prompts or password changes Phishing, impersonation or accidental link/credential entry Malware, ransomware, unusual slowness or locked files Information sent, shared or exposed to the wrong person Lost or stolen devices, storage or paper records Unauthorised system changes, outages or denial of service

Uncertainty is not a reason to wait. Report suspicious activity promptly and let the incident lead assess it.

First calls

Primary incident leadComplete before issuingPhone not recorded
Fallback leadComplete before issuingPhone not recorded
IT/cyber providerNot recordedContact not recorded
Cyber insurerNot recordedContact not recorded

What any staff member should do

  1. Recognise and report. Call the primary incident lead immediately. If they do not answer, call the fallback lead and IT/cyber provider. Do not rely only on email or voicemail.
  2. Stop interacting. Do not click further, reply, pay, delete messages, run cleanup tools or keep using a suspected account or device.
  3. Contain safely. If malware or ransomware is actively affecting a device, disconnect its network cable and turn off Wi-Fi/Bluetooth. Leave it powered on unless there is immediate physical danger or an adviser directs otherwise.
  4. Preserve information. Note the time, what happened, what was clicked or entered, affected people/devices and any messages on screen. Photograph the screen with a separate device if safe.
  5. Use a safe channel. If normal email or chat may be compromised, use the approved alternative: Complete an alternate communication method before issuing this plan.

Incident lead checklist

1 — Activate

Start an incident log. Confirm decision-makers, engage the IT/cyber provider and insurer, and move communications to a trusted channel if necessary.

2 — Contain

Isolate affected systems and accounts with specialist guidance. Avoid unnecessary changes that could destroy evidence or breach insurance conditions.

3 — Assess

Identify what happened, when it began, systems and data affected, ongoing access, operational impact and the people who may face serious harm.

4 — Notify

Coordinate reports and messages with legal/privacy advice. Notify authorities, affected people, clients, funders or regulators where required. Explain protective actions and material service disruption accurately, without speculation.

5 — Recover

Remove the cause, restore from known-good backups, reset affected credentials, validate systems and increase monitoring before returning to normal operations.

6 — Improve

Run a blame-free review, document the timeline and decisions, address root causes, update this plan and test the changed process with staff.

Quick playbooks

Suspicious email or compromised account

Stop using the account. Contact the incident lead from a trusted device. Preserve the message. The authorised administrator should revoke sessions, reset credentials, review MFA and forwarding rules, check sign-in activity and identify affected messages or data.

Malware or ransomware

Disconnect affected devices from wired and wireless networks, but do not power them off unless directed or physically unsafe. Do not pay, negotiate, restore or run cleanup software before contacting the incident lead, IT/cyber provider and insurer.

Lost or stolen device

Report it immediately with the last known location and time. Revoke sessions and remotely lock or wipe only through an authorised person. Consider what information was accessible, whether the device was encrypted and whether police or privacy notifications are required.

Information sent to the wrong person

Do not send further copies. Ask the unintended recipient not to access, use or share the information and to securely delete it, but do not assume that resolves the breach. Record what was disclosed and obtain privacy/legal advice about containment, assessment and notification.

Organisation-specific information

Plan owner
Not recorded
Critical systems
Not recorded
Essential services
Not recorded
Plan locations
Not recorded
Legal/privacy adviser
Not recorded
Communications lead
Not recorded
Other obligations and contacts
None recorded—confirm before issuing

Australian reporting and privacy reminders

  • ASD/ACSC: ReportCyber and the Australian Cyber Security Hotline (1300 CYBER1 / 1300 292 371) provide a reporting and assistance pathway.
  • OAIC: An organisation covered by the Privacy Act should promptly assess a suspected eligible data breach. The assessment should generally be completed within 30 days; if an eligible breach is confirmed, notification must occur as soon as practicable.
  • Other obligations: Insurance, contracts, sector regulation, funding agreements, law enforcement and critical-infrastructure rules may create additional contacts or timeframes. Obtain advice for the actual incident.

Close-out and improvement

  • Hold a blame-free review and record the timeline, impact, decisions and lessons.
  • Apply required patches, configuration changes and account-security improvements.
  • Provide targeted staff training where human or process factors contributed.
  • Confirm affected people received promised updates and protective guidance.
  • Update this plan, contact details and playbooks, then test the changed response.

Review and test: Walk through this plan with staff at least annually and after material system, supplier or staffing changes. Keep an authorised hard copy somewhere accessible if normal systems are offline.

This generated plan is general information, not legal, regulatory, insurance or incident-specific cyber security advice. The organisation remains responsible for adapting, approving and testing it.

Generated with Suburban Secure · suburbansecure.au/free-cyber-incident-response-plan/

Use the plan before you need it.

Print a controlled copy, tell staff where it is and run a short scenario while everyone is calm. ASD specifically recommends keeping a hard copy in case systems go offline and testing plans through exercises.

If you would like Suburban Secure to review the result, tailor the playbooks or run a practical exercise with your team, request a fixed-scope review.

Ask for help tailoring the plan

Official guidance used