An AI cyber incident response plan writer for the day your systems go dark
An incident response plan is read in the worst conditions. Email may be down, the usual approver may be on leave and people are frightened. A plan that only makes sense to the person who wrote it fails at exactly that moment. INKFLOW drafts a cyber incident response plan, with scenario playbooks such as ransomware, around your own people, systems and obligations.
Name it in your brief, for example 'incident response plan with a ransomware playbook', and the writer works from guidance for security incident plans. It asks for what such a plan rests on: who has authority to disconnect systems, which data you hold and where, your insurer's conditions, your outside responders and the regulators you may have to tell.
What you give it is what the plan contains. Contacts, deadlines and decision rights you have not confirmed are left as marked placeholders. The result is a draft for your security lead, legal adviser and board to review and approve.
Your critical systems and services in recovery order, and the categories of personal and sensitive data you hold. This is what the plan protects, and it shapes every containment decision.
2
Name the people and their authority
Roles, deputies and who may pull a system offline, call in outside help, speak to the press or notify a regulator. Give two ways to reach each contact, and say how the team will talk if your own email and chat are compromised.
3
Choose the scenarios
Pick the playbooks your own risk assessment points to: ransomware, a hijacked mailbox, data theft, a breach at a supplier. Each gets its own sequence rather than one generic flow.
4
Order, review, then rehearse
The price appears before payment. When the draft arrives, walk it through a tabletop exercise before you approve it; gaps show up quickly when people act a plan out.
Inside the incident response plan and its playbooks
Phases people can follow
Preparation, detection and assessment, containment, eradication, recovery and lessons learned, the shape most published frameworks share, written as actions with an owner against each.
A ransomware playbook that names the hard decision
Who decides whether a demand is even discussed, where that decision is recorded, and what happens to evidence and backups first. The board's position comes from you; the plan never adopts one for you.
Notification duties as a checklist
Regulators, sector bodies, customers under contract and your insurer, each with the deadline you or your adviser confirm. Personal data breaches route to your data protection lead.
Out-of-band communication
A fallback channel for the response team that does not rely on the systems under attack, plus who approves internal, customer and media statements.
Links to the plans you already have
Business continuity, disaster recovery and crisis plans are referenced rather than rewritten, so the documents do not contradict one another.
A testing and review cycle
Room for your exercise history and the schedule you agree, so the plan is kept alive instead of filed.
Where an incident response plan from INKFLOW stops
INKFLOW is not an incident response service and does not monitor, scan or test your network. If an attack is happening now, contact your responder, your insurer's helpline or the NCSC first. A document will not help you in the next hour.
It is not legal advice either. Reporting duties under UK GDPR, the NIS Regulations or your contracts depend on facts only you and your lawyer can weigh, so the deadlines in the plan are the ones you confirm. Nor does it choose your stance on paying a ransom.
Questions
Is the plan based on a recognised framework?
Its structure follows the incident lifecycle that public guidance, such as the NCSC's and NIST's, describes. The plan is yours rather than a copy of either, and it does not claim conformity with any scheme.
Can it write separate playbooks for different attacks?
Yes. List the scenarios you want covered and each is written as its own playbook with its own triggers, decisions and contacts.
Will it fill in the regulator deadlines for us?
Only the ones you give it. Notification rules change and depend on your sector and your data, so any deadline you have not confirmed is a placeholder for your adviser to complete.
We already have an IT incident process. Is this the same thing?
Not quite. An IT runbook deals with outages and faults; a security incident plan adds evidence handling, legal duties and communications. Many organisations keep both and link them.
Can our existing plan be brought up to date instead?
Yes. Upload it to have it revised, with your contacts and decisions kept as they are.
Do prices include VAT?
Prices include any VAT; nothing is added at checkout.
We are an organisation. How can we pay?
Single orders are paid by card at checkout. For subscriptions and repeat orders, care homes, councils and businesses can ask about paying by Direct Debit or standing order at app.inkflowstudio.org/organisations.
Tell us what it is for, and it is written to the standard. In the free sample, any figure that must come from your own material is left as a marked placeholder.