Incident-readiness questionnaire

How to use this resource

Intended for Executives, IT and security leaders, incident coordinators, communications teams, legal and privacy contacts, service owners, and recovery teams. Typical completion time: 45 to 90 minutes as a facilitated cross-functional discussion.

• Complete this with the people who would make decisions and perform the work, not as a security-team-only survey.
• For each yes, record the document, system, test, or other evidence that supports the answer.
• For unknown or no answers, assign a follow-up owner and date.
• Do not include breach details, personal information, credentials, or confidential legal advice in the questionnaire.
• Use a scenario exercise to test critical answers. A completed questionnaire is not proof of readiness.

Authority and activation

• QuestionsWhat conditions cause the organization to declare a security incident, and who has that authority?
• QuestionsWho acts as incident coordinator during business hours and after hours?
• QuestionsWho can authorize isolation of a user, endpoint, server, site, network segment, cloud tenant, or third-party connection?
• QuestionsWho can approve service shutdown, emergency purchasing, specialist support, public statements, and restoration to production?
• QuestionsAre deputies named for each critical role, with current contact information?
• QuestionsCan the response team operate if normal identity services, corporate email, chat, VPN, or telephony are unavailable?
• QuestionsIs there a protected, accessible copy of the incident plan and contact list outside the primary environment?

Detection, intake, and triage

• QuestionsCan staff and third parties report a suspected incident through a known channel at any time?
• QuestionsWho monitors reports and security alerts, and what happens when the primary contact does not respond?
• QuestionsAre triage criteria defined for severity, scope, data sensitivity, safety, operational impact, and suspected threat activity?
• QuestionsCan responders identify affected users, devices, services, network paths, cloud resources, and data owners quickly?
• QuestionsAre time sources synchronized well enough to compare logs across in-scope systems?
• QuestionsAre important log sources inventoried, monitored for collection failure, access-controlled, and retained for an approved period?
• QuestionsHas the organization tested a detection and escalation path using a harmless simulated event?

Communications and external parties

• QuestionsIs there a current call tree with personal or alternate contact methods where approved?
• QuestionsDoes the team have an out-of-band conference or messaging method that does not depend on the affected environment?
• QuestionsWho communicates with staff, customers, suppliers, media, and other stakeholders, and who approves each message?
• QuestionsAre cyber insurer and broker contacts, policy numbers, notification conditions, and consent requirements readily available?
• QuestionsAre external incident-response, legal, privacy, communications, law-enforcement, hosting, cloud, telecom, and critical vendor contacts documented where applicable?
• QuestionsWho determines whether contractual, privacy, regulatory, or other notification duties may apply?
• QuestionsAre communications logged with time, sender, recipient, decision, and approval without exposing unnecessary sensitive information?

Containment and technical access

• QuestionsDo responders have authorized, tested methods to isolate endpoints, disable accounts, revoke sessions, block indicators, and restrict network paths?
• QuestionsAre emergency accounts protected, monitored, tested, and available if the normal identity platform is impaired?
• QuestionsCan administrators reach critical platforms without relying solely on the affected network or identity service?
• QuestionsAre current network diagrams, cloud inventories, administrative boundaries, and service dependencies accessible during an incident?
• QuestionsAre containment actions recorded with approver, implementer, time, scope, expected effect, and rollback considerations?
• QuestionsDoes the team know which systems cannot be isolated without safety, contractual, or severe operational consequences?
• QuestionsAre service providers' response responsibilities and emergency change processes understood?

Evidence and investigation

• QuestionsIs a qualified role assigned to direct evidence preservation and investigation?
• QuestionsDo procedures address volatile data, endpoint images, cloud logs, email records, network data, and physical devices as applicable?
• QuestionsCan the organization record who collected, transferred, accessed, and stored evidence?
• QuestionsAre evidence repositories access-controlled, capacity-checked, and separated appropriately from affected systems?
• QuestionsDoes the plan distinguish operational fact-finding from legal advice and privileged work?
• QuestionsCan the team preserve relevant records before routine retention or automated deletion removes them?
• QuestionsAre privacy, employment, contractual, and legal considerations referred to qualified internal or external advisers?

Eradication, recovery, and return to service

• QuestionsWho decides that the cause and persistence mechanisms are understood well enough to begin recovery?
• QuestionsAre trusted software, configurations, certificates, keys, accounts, and build sources available for recovery?
• QuestionsCan identity and privileged-access services be recovered early in the sequence?
• QuestionsAre backups protected from ordinary administrator compromise and tested for complete service recovery?
• QuestionsDo recovery runbooks identify dependencies, recovery order, validation owners, and business acceptance criteria?
• QuestionsHow will the team check for reinfection, unauthorized access, data integrity issues, and failed controls before reconnecting systems?
• QuestionsWho accepts residual risk when a service returns before every corrective action is complete?
• QuestionsCan the organization operate manually or at reduced capacity while restoration continues?

Ransomware and extortion decisions

• QuestionsDoes the plan address encryption, data theft, extortion, destructive activity, and public-pressure tactics as distinct possibilities?
• QuestionsAre decision-makers aware that restoration, notification, sanctions, law-enforcement, insurer, legal, and negotiation questions may require specialist advice?
• QuestionsCan the organization communicate with responders without using systems controlled by the threat actor?
• QuestionsAre known-good recovery credentials and documentation protected from the primary environment?
• QuestionsHas leadership discussed decision authority and information needs without pre-committing to a payment decision?

People and welfare

• QuestionsAre shifts, handoffs, rest, and decision logs planned for incidents lasting more than one working period?
• QuestionsIs there a process to protect staff from harassment, doxxing, or social engineering connected to an incident?
• QuestionsCan the team bring in additional technical, administrative, communications, or leadership support?
• QuestionsAre sensitive personnel matters limited to people with a need to know?
• QuestionsDoes the after-action process avoid blame and focus on decisions, conditions, and control improvements?

Exercises and improvement

• QuestionsWhen was the incident plan last exercised, and which teams and scenarios were included?
• QuestionsDid the exercise test actual contacts, access paths, decisions, and recovery steps rather than discussion alone?
• QuestionsWere observations converted into actions with owners, target dates, and closure evidence?
• QuestionsHave material changes in systems, suppliers, staffing, insurance, or obligations been reflected in the plan?
• QuestionsIs the next exercise scheduled, with a different scenario or objective?

Action register

• Repeatable columnsAction ID
• Repeatable columnsQuestion reference
• Repeatable columnsGap or uncertainty
• Repeatable columnsConsequence
• Repeatable columnsImmediate precaution
• Repeatable columnsOwner
• Repeatable columnsTarget date
• Repeatable columnsDependency
• Repeatable columnsEvidence required for closure
• Repeatable columnsStatus
• Repeatable columnsValidated by and date

Important limitations

For general operational use only. These materials are not legal advice, compliance advice, a warranty, or a complete control framework. Using a template does not establish that a change, assessment, incident plan, or recovery capability is adequate. Obtain appropriate technical, legal, privacy, insurance, and regulatory advice for your circumstances.

• This questionnaire helps structure a readiness discussion. It does not guarantee prevention, response effectiveness, recovery time, insurance coverage, or compliance.
• Do not place passwords, private keys, recovery codes, sensitive personal information, or unredacted secrets in forms, worksheets, tickets, or email. Use an approved secure channel for confidential material.
• Resource version 1.0. Suggested download filename: hai-incident-readiness-questionnaire.html.