Free Cyber Incident Response Toolkit for UK SMEs
A free, editable cyber incident response toolkit for UK SMEs: plan, checklists, incident log, severity matrix, playbooks, breach assessment and tabletop exercises. No sign-up.
What's inside
- An editable incident response plan template
- A printable first-72-hours checklist
- Incident log and evidence register in Excel
- A severity matrix and seven incident playbooks
- A personal data breach assessment and communications pack
- Four tabletop exercises for team training
Preparing for a cyber incident is far easier with the right documents ready to go. This free toolkit gives UK SMEs a complete, editable set of incident-response templates: a plan, checklists, logs, a severity matrix, playbooks, a breach assessment and tabletop exercises. No email address, no sign-up. Download it, adapt it, and start building your capability this week.
The toolkit is the practical companion to our full guide, Cyber Incident Response Plan for UK Businesses: What to Do in the First 72 Hours. The guide teaches the how and why; this page gives you the files.
Download the complete toolkit
All eleven templates and checklists plus a README, in one ZIP. Word and Excel files are editable; PDFs are print-ready.
Or download individual templates
Incident Response Plan Template
A fill-in plan for your organisation: roles, authority to act, contacts, severity and process. Complete this before an incident.
First 72 Hours Checklist
A printable, tickable checklist for the first 15 minutes, hour, 4 hours, 24 hours and 72 hours. Keep a copy offline.
Incident Log
Record every action, finding and decision with timestamps. Frozen headers, filters and a status dropdown. No macros.
Severity Assessment Matrix
Grade an incident Critical, High, Normal or Low by impact and risk, with assessment factors and worked examples.
Emergency Contact Sheet
One page of the people and providers you will need. Print it and keep it offline, because you will need it when systems are down.
Evidence Register
Track the evidence you collect with a light-touch chain of custody: source, collector, hash, storage and access history.
Personal Data Breach Assessment
Work through whether a personal data breach must be reported to the ICO, and record your reasoning. Practical aid, not legal advice.
Incident Communications Pack
Six adaptable holding templates: staff notice, service-down notice, management SITREP, customer holding statement, supplier request and recovery update.
Cyber Incident Playbook Pack
Seven quick, defensive playbooks: phishing and BEC, Microsoft 365 compromise, ransomware, data breach, lost device, supplier and website compromise.
Post-Incident Review Template
Turn an incident into improvement with a structured, no-blame review: timeline, root causes, what worked, what failed and owned actions.
Tabletop Exercise Pack
Four ready-to-run rehearsal scenarios with timed injects and discussion questions, each about an hour. Great for team training.
How to use the toolkit
| Stage | Which files |
|---|---|
| Complete before an incident | Incident Response Plan, Emergency Contact Sheet |
| Print and keep offline | First 72 Hours Checklist, Severity Matrix, Emergency Contact Sheet, and a printed copy of your completed plan |
| Use during an incident | Checklist, Incident Log, Severity Matrix, Evidence Register, Breach Assessment, Communications Pack, Playbook Pack |
| Use afterwards | Post-Incident Review |
| Use to rehearse | Tabletop Exercise Pack (run one or two a year) |
Not sure where to start? Read the full guide first: Cyber Incident Response Plan for UK Businesses. It walks through every stage, from the first 15 minutes to safe recovery, and explains how to use each template.
Want help turning these templates into a real capability?
Downloading templates is a great start. If you would like someone to review your incident-response readiness, across identity, logging, backups, roles and reporting, and give you a plain, prioritised list, we can help.
Frequently asked questions
Yes. Every file is free to download with no email address or registration required. Use it, adapt it and share it within your organisation. If you find it useful, we would simply suggest reading the accompanying guide and, if you want expert help, getting in touch.
That is the idea. The Word and Excel files are fully editable: replace the placeholders, add your own contacts and roles, and adapt them to how your business works. The PDFs are print-ready reference documents. You can also save any Word or Excel file as a PDF from within the app.
Start with the Incident Response Plan Template and the Emergency Contact Sheet, and agree them with your leadership team. Then print the checklist, severity matrix and contact sheet, along with a copy of your completed plan, and keep them somewhere that does not depend on the systems you might lose in an incident.
No. These are practical templates to help you prepare and respond. They are not a substitute for legal advice or for current guidance from the NCSC and the ICO. For anything with regulatory or legal weight, check the current official guidance and take professional advice for your circumstances.
Train your team
Join a free System Force cyber-security webinar and run these scenarios with your people.
Stay a step ahead
Get our weekly IT and cyber-security briefing: plain-English updates for UK businesses.