Incident response plan

Emergency manual for cyber incidents

What is an incident response plan?

Minimum content of an IRP:

• Crisis team + escalation paths
• Communication templates (employees, customers, authorities)
• Forensic procedures (imaging, securing logs)
• Report to the authorities (BSI 24/72/30)
• Recovery procedures
• Post-incident review

Legal basis in Germany and Austria

Incident response is at the same time a statutory risk management measure (handling of security incidents) and the trigger for the reporting obligation. The obligations are the same in substance, but refer to different laws and authorities.

Germany

• Incident handling as a mandatory measure: § 30(2) no. 2 BSIG (handling of security incidents).
• Reporting obligation: § 32 BSIG – early initial report within 24 hours, report with an initial assessment within 72 hours, final report no later than one month after the 72-hour report.
• Competent body: joint reporting office of the Federal Office for Information Security (BSI) and the Federal Office of Civil Protection and Disaster Assistance (BBK).

Austria

• Incident handling as a mandatory measure: § 32(4) of the Austrian Network and Information Systems Security Act 2026 (NISG 2026) (risk management measures, all-hazards approach).
• Reporting obligation: § 34(2) NISG 2026 – early warning within 24 hours, report with an initial assessment within 72 hours, final report no later than one month after the 72-hour report.
• Competent body: the competent sector-specific or national CSIRT (not the BSI); supervision by the Cybersecurity Authority (Cybersicherheitsbehörde, Austria).

Practical example

Suspected ransomware: IRP trigger. The crisis team convenes within 30 min. Forensics starts imaging. Initial BSI report within 24h. Recovery from backup. Post-incident: lessons-learned workshop.

See also

• Incident
• CSIRT
• Section 30 BSIG