A readiness check is only useful if you can show each item working today. This incident response checklist gives an IT head, IT manager or business owner at a firm in India or the GCC 18 checks, each with the evidence to collect and a pass test. It assumes you already have a response plan, and it checks that plan rather than showing how to write one. It is a self-check, not legal advice and not a certificate.
Last reviewed 2026-11-01 by Manish Sharma.
Incident Response Checklist: What It Tests, and Where NIST Stands
This checklist asks whether your team could respond today. It does not walk through what to do while an incident is under way. If you need a definition, see what incident response is.
NIST SP 800-61 Rev. 3, published in April 2025, supersedes Rev. 2 from August 2012. NIST titles it a CSF 2.0 Community Profile, and its executive summary says all six CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond and Recover) play vital roles in incident response. In its Improvement notes, NIST advises evaluating the incident response programme periodically, and lists self-assessments, third-party assessments and independent audits as possible forms. It adds that incident response exercises and tests may provide helpful information for that evaluation. This checklist is a self-assessment of that kind, and the grouping and the pass tests are Signisys’ own.
The reader in mind runs a small IT team with no dedicated incident team, in a firm of a few hundred people. The checks support improving threat detection and response, but they start where detection ends, when someone declares an incident.
Key Takeaway A check counts only when someone who did not write the plan can show it working, with a date.
How to Score the Incident Response Checklist
The scoring rule, the sampling rule and the totals below are Signisys’ own explanation. Mark each check:
- Pass, 2 points: you meet the pass test and hold dated evidence.
- Partial, 1 point: you meet the test for some roles or systems, or the evidence is missing.
- Fail, 0 points: you do not meet the test.
The maximum is 36, when all 18 checks score Pass. No evidence means not passed, even if the team believes otherwise. The checklist gives no target score, because any band would be a guess. The useful number is the count of Fails in each group, rather than the total.
Where a test says “sample”, pick three people or entries at random and write the picks down, so the result can be repeated.
Keep one dated folder, including the name of the person who ran each check. CISA’s response playbooks, published in November 2021 for US federal civilian agencies, use “Actions Taken” and “Date Complete” columns in Appendix C, which is the same record idea. Those playbooks came before NIST Rev. 3. We suggest you limit access to the folder to the IT lead and one reviewer. The same habit, applied to a network, is in the evidence-folder step of the network audit list.
In our view, the person who wrote the plan should not mark it. If you can, ask a colleague from outside IT to run the tests.
Record the date and the exact result, for example “reached 4 of 5”.
Incident Response Checklist: 18 Checks in Six Groups
Each table gives the check, the evidence to collect and the pass test. Each check names its source where it draws on one; the pass tests are Signisys’ own.
Checks 1 to 4: People and Authority
The first part of the incident response checklist asks whether named people can act without asking permission. India has reporting directions issued by CERT-In; ask your legal adviser which apply to you.
| Check | Evidence | Pass test |
|---|---|---|
| 1) Every response role has a named person and a backup | A role sheet, including names, backups and a date | If each backup answers a test call and holds no second role, the check passes |
| 2) Authority to isolate a system is in writing | A signed note naming who may take a system offline | When the named person, asked cold, confirms the authority and says whom to tell, the check passes |
| 3) You name outside help before you need it | Contact entries for forensic support, legal counsel and the insurer | If each entry has a contact who answered the last contact test, the check passes |
| 4) Someone owns the question of reporting duties | A dated note from the firm’s legal adviser | When the note lists which duties apply and names who sends each report, the check passes |
For check 2, NIST Rev. 3, section 2.3, lists roles, responsibilities and authorities, such as which roles have the authority to confiscate, disconnect or shut down technology assets, among the elements of a response policy. The checks and the tests in this group are Signisys’ own.
Checks 5 to 7: Contacts and Channels
NCSC’s incident management guidance says key contacts should ideally include at least two contact methods and two or more people, or a group. It also asks for at least one conference number, kept available for urgent incident calls. CISA’s IRP Basics guide suggests printing the plan and contact list for people with a role, because email, chat and storage may be unavailable.
Checks 5 to 7 of the incident response checklist test whether you can reach the people on the list when email and chat are down.
| Check | Evidence | Pass test |
|---|---|---|
| 5) The contact list is current | The list, with a date and two ways to reach each person | If three sampled people answered on both methods in the test, the check passes |
| 6) A second channel works without email or chat | The channel’s details and the log of a test call | When every role-holder joined the test without corporate email or chat, the check passes |
| 7) The people who need printed copies hold them | A list of copy holders, including the version and date | If each holder shows a copy that matches the current version, the check passes |
Checks 8 to 10: Severity and Escalation
Our view is that severity only helps when two people sort the same case the same way. These checks test the table, rather than the factors behind it. NIST Rev. 3, section 2.3, lists a definition of events, cybersecurity incidents and related terms, and guidelines for prioritizing incidents and estimating their severity, among the elements of a response policy. NCSC adds that the people escalated to must have the authority to make critical decisions, and advises considering deputies.
| Check | Evidence | Pass test |
|---|---|---|
| 8) Severity levels are in writing | A one-page table of levels and whom to tell at each | When two people sorted three sample cases into the same levels without help, the check passes |
| 9) The plan says what counts as an event and as an incident | The page that defines both terms for the firm | If different people sorted five past alerts twice with the same result, the check passes |
| 10) Every escalation point has a deputy | The escalation list showing a deputy for each point | When each level names whom to tell and who may act alone, the check passes |
Checks 11 and 12: Records and Evidence
NCSC notes that keeping track of a response is very important in cases that regulators or courts may later review. In the incident response checklist, these two checks confirm that the record and the evidence rules exist, but not how to collect evidence.
| Check | Evidence | Pass test |
|---|---|---|
| 11) The team names a recorder and has a response log ready | A blank time-stamped log and the log from the last exercise | If the last exercise log has timed entries for each decision and action, the check passes |
| 12) The team has decided how to handle evidence | A note on who may collect evidence and where it sits | When the note names who may approve wiping a device and limits access to the store, the check passes |
Checks 13 to 15: Recovery and Continuity
We think a recovery nobody has tried is a hope, not a check. These checks look for a short system list, one restore that worked, and plans that refer to each other. NCSC also describes inter-linked business continuity, disaster recovery and communications plans. CISA’s Appendix C, item 3b, asks agencies to conduct recovery exercises to test continuity of operations, including failover, backup and recovery systems.
| Check | Evidence | Pass test |
|---|---|---|
| 13) A short list of critical systems exists, with owners | The list with an owner and a business impact for each | If each owner confirms their entry and the order of restore, the check passes |
| 14) A recovery from backup has a test | The restore log, including date, system and time taken | When one critical system came back from the latest backup within the time you wrote down before the test, the check passes |
| 15) The response plan and the continuity plan refer to each other | Both documents, with the same system list in each | If each plan names the other and the continuity contact sits on the contact list, the check passes |
Checks 16 to 18: Practice and Upkeep
In our view, a rehearsal shows what reading the plan does not. Checks 16 to 18 of the incident response checklist cover practice and upkeep. NIST Rev. 3 points to its SP 800-84 for simulations, tabletop discussions and other forms of exercises. For upkeep, the sources differ: NIST advises periodic evaluation, CISA’s IRP Basics (a PDF that shows no date) says to review the plan quarterly, and the Canadian Centre for Cyber Security’s ITSAP.40.003 (January 2026) says to test, revisit and revise the plan annually. The firm picks one rhythm, then writes it down.
| Check | Evidence | Pass test |
|---|---|---|
| 16) A rehearsal has run on a scenario that fits the firm | A dated exercise note, including the scenario and the attendees | When every role-holder or backup took part and the scenario involved a system from the check 13 list, the check passes |
| 17) Exercise findings have owners and dates | The action list from the last exercise | If each action has an owner and a date, and closed items changed the document, the check passes |
| 18) The plan has an owner, a next exercise date and a review rhythm | The front page of the plan showing all three | When the plan shows all three and the review rhythm is written on that page, the check passes |
Key Takeaway The useful result is the number of Fails in each group, not the total.
The Eight-Question Drill: Answer Without Opening the Plan
This drill is a short meeting, not a test of memory for its own sake. Ask the role-holders to answer without the document, and use ransomware as the scenario, as in ransomware protection and recovery. The eight questions are Signisys’ own, built from checks 1 to 17.
- Who takes command?
- Which severity level does a new case get, and who decides?
- Who may isolate a system?
- Whom must we tell, and who decides which outside duties apply?
- How does the team talk if email is down?
- Where is the response log kept, and who keeps it?
- Which critical system would we restore first, and from what?
- What did the last exercise find, and did we fix it?
Write each answer next to the plan. An answer that differs from the plan, or from a colleague’s, is a Partial on the matching check. Run the drill once for a baseline, then again after the exercise in check 16.
Turn Your Incident Response Checklist Results into a Fix List
Count the Fails in each group, rather than just the total. We suggest this order: fix the checks that stop people reaching each other and acting (groups 1 and 2) first. Then fix the decisions that slow the first hour (groups 3 and 4), and then recovery and practice.
Use our guide to ranking your cyber risks to order whatever remains. We think Fails on checks 1 to 4 and 8 to 10 are decisions to write down, not tools to buy.
Hand over a findings list with an owner, a date and a re-test date for each Fail. Re-test each closed item when the fix is done, using the same pass test. Signisys’ guide to building the response plan covers the how; this page only checks the result.
When to Ask for an Outside View
This is Signisys’ view, not a rule. An outside reader helps when you need an independent reading of the evidence, or when a customer, insurer or regulator asks for one. Read what each asks for before you decide. NIST names third-party assessments and independent audits as possible forms of evaluation, as noted above.
An outside view also helps when nobody outside IT can mark the tests, or when checks 16 to 18 keep failing after a fix. In our view, an outsider can add a useful view on checks 2, 3, 12 and 16, which cover authority, outside help, evidence and rehearsal.
Signisys offers help with incident response planning and response exercises.
What This Checklist Does Not Cover
This page covers a self-check of response readiness. It leaves out how to build the plan, why attacks go unnoticed, the choice of tools, and legal advice on reporting. Signisys’ guides on the response plan, on undetected attacks and on the comparison of hunting tools cover the first three. Passing every check does not show that the team will cope with a real incident, because only an exercise tests that. For the restore side of a ransomware attack, our article on what breaks at restore time follows one attack through to recovery.
Signisys provides cybersecurity services for growing firms, including help with planning and response exercises. The cybersecurity services page lists what Signisys offers, while the decisions on each gap stay with your own team.
Incident Response Checklist FAQ
What should an incident response checklist include?
Who should run the checklist?
Does passing the incident response checklist mean the team is ready?
How is the readiness checklist scored, and what is a good result?
Can a small IT team do this without outside help?
When should you run the checklist again?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.