Cyber Decision Lab
Free operational work product

Free Incident Response Checklist

Start with the first 15 minutes. Then tailor a full checklist for your team.

First 15 Minutes Customize my checklist
Free No signup No uploads Your inputs stay in your browser
Quick reference · no questions required

First 15 Minutes

General coordination steps. Adapt them to your approved plan and current safety risks; actions may run in parallel.

  1. Check immediate safety and business impact. Identify what is affected. Escalate threats to people or essential operations immediately.
  2. Assign an incident lead. Agree who can authorize containment, who investigates, and who records decisions.
  3. Open an authorized incident record. Record the detection time, verified facts, impact, and decisions in your approved system.
  4. Preserve evidence while limiting harm. Retain relevant logs and volatile evidence where feasible; do not delay urgent authorized containment solely to collect everything.
  5. Choose containment deliberately. Network isolation, access restriction, and shutdown have different effects. Use the relevant playbook and assess operational and evidence risks.
  6. Use a trusted communication channel. Reach your response team through verified contacts; if email is compromised, use a known-safe alternative. Set the next update time.

For a serious incident, involve qualified responders. This page cannot investigate systems or manage an emergency. Use your browser’s print command for this quick reference.

Cyber Decision Lab · Paragamix GmbH · cyberdecisionlab.com · September 9, 2026

Optional: customize the full response checklist →
Step 1 of 2

Set the operating context

Local only

Optional: tailor the full checklist using broad categories. Leave anything unconfirmed as unknown. Do not enter real incident details.

Incident type

Your inputs stay in this tab. Reloading or closing it clears your work. Print first if you need a copy. No signup, cookies, analytics, or answer uploads.

Field guide

Published by Paragamix GmbH · Updated September 9, 2026 · Methodology and review status

Use the checklist under an approved response plan

Unlike a static incident response checklist template or quick-reference PDF, this browser-local builder adapts the work product without collecting incident data. It removes avoidable decisions from the first hours without pretending every incident follows the same script.

Checklist vs. response plan

Your plan defines policy, authority, contacts, reporting obligations, and governance. This checklist turns that structure into trackable actions for a specific type of event. Keep technical playbooks separate and controlled.

What the first 15 minutes are for

The goal is not instant root cause. Establish control: confirm there is an incident, name the lead, start an approved record, protect evidence, assess impact, and choose containment only with the right authority.

Ownership and documentation

Use roles instead of relying on a single person. Log verified facts, timestamps, decisions, evidence references, and handoffs in your authorized incident system. Never place live incident data in this tool.

Exercise, learn, improve

Run tabletop exercises regularly and after material changes. After an incident, turn lessons into owned corrective actions, updates to playbooks, training changes, and measurable follow-through.

Primary references

Grounded in current US guidance

Frequently asked questions

Incident response checklist FAQ

What is an incident response checklist?

It is a concise sequence of roles, decisions, and actions that helps a response team coordinate detection, containment, recovery, and follow-up. It supports—but does not replace—an approved incident response plan and incident-specific technical playbooks.

What should happen in the first 15 minutes?

Establish command, open an authorized record, validate the signal, assess immediate business impact, preserve volatile evidence, and confirm who can authorize containment. Avoid destructive or irreversible actions made without evidence or authority.

How is a checklist different from an incident response plan?

A plan defines governance, authority, communications, contacts, and the overall response process. A checklist is the short operational guide used to execute and track important actions.

Who should own incident response?

One incident lead should coordinate decisions and handoffs, supported by technical, executive, legal/privacy, communications, and business roles. The exact owner depends on the organization and its approved authority model.

What should be documented?

Record verified facts, detection and decision times, roles, impact, evidence references, containment and recovery decisions, communications, and open risks in your organization’s authorized incident system—not in this public browser tool.

How often should the checklist be tested?

Test it during regular tabletop exercises and after significant technology, staffing, vendor, or business changes. Review it again after each incident or exercise and assign owners to improvements.