thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Incident Response Plan (IRP)

A documented set of policies, roles and procedures guiding how an organization responds to security incidents.

Definition

An IRP defines scope, incident categories and severity, roles and responsibilities, communication and escalation paths, external contacts (legal, law enforcement, insurers), playbooks and requirements for testing and updating the plan. It must be approved by management and tested regularly.

Example

An IRP specifying that the CISO declares major incidents and legal approves external communications.

Exam tip

An untested plan is a common exam trap; tabletop exercises are the expected validation.

Related terms