# Cyber Incident Response Plan Template for Manufacturers

> Source: https://netray.co/tools/manufacturing-cyber-incident-response-plan-template
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A fill-in incident response plan covering roles, severity levels, containment of IT and plant floor systems, communications and recovery, exportable as a document.

## Category

industry-templates

## Industry

Discrete Manufacturing

## Audience

- IT security lead
- CIO
- Plant manager

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company name

**Key:** company

**Type:** text

**Default:** Acme Precision Ltd

#### Site covered

**Key:** site

**Type:** text

**Default:** Plant 1, Columbus OH

#### Plan version

**Key:** version

**Type:** text

**Default:** 1.0

#### Effective date

**Key:** date

**Type:** date

**Default:** 2026-11-01

#### Incident commander (role and name)

**Key:** ir_lead

**Type:** text

**Default:** IT Security Lead, J. Rivera

#### Plant operations lead

**Key:** plant_lead

**Type:** text

**Default:** Plant Manager, S. Okafor

#### Executive sponsor

**Key:** exec_sponsor

**Type:** text

**Default:** COO

#### 24x7 incident phone or channel

**Key:** hotline

**Type:** text

**Default:** +1 555 0100 (security on-call)

#### External IR retainer firm

**Key:** ir_firm

**Type:** text

**Default:** To be completed (retainer provider)

#### Cyber insurer and claims line

**Key:** insurer

**Type:** text

**Default:** To be completed (policy number and claims phone)

#### Critical systems in scope

**Key:** systems

**Type:** textarea

**Default:** ERP database and application servers, MES, quality system, CNC DNC server, active directory, backup server, plant historian.

#### Target restore time for critical systems

**Key:** rto

**Type:** text

**Default:** ERP 24 hours, MES 8 hours, DNC 4 hours

**Blocks:**

#### Cyber Incident Response Plan

**Body:** Organization: {{company}}
Site: {{site}}
Version: {{version}}
Effective: {{date}}

Purpose: to define how {{company}} detects, contains, investigates, recovers from and learns from cybersecurity incidents affecting business IT, the ERP and plant floor (OT) systems.

#### 1. Roles

**Table:**

**Columns:**

- Role
- Responsibility
- Named person

**Rows:**

**0:** Incident commander

**1:** Owns decisions, severity, timeline and log

**2:** {{ir_lead}}

**0:** Plant operations lead

**1:** Decides on production stops, manual operation and safety

**2:** {{plant_lead}}

**0:** Executive sponsor

**1:** Approves major decisions such as ransom policy, shutdowns, public statements

**2:** {{exec_sponsor}}

**0:** Communications lead

**1:** Employees, customers, regulators, media

**0:** Legal and compliance

**1:** Notification duties, evidence preservation

**0:** ERP and application owner

**1:** Restores ERP and integrations from backup

#### 2. Severity levels

**Table:**

**Columns:**

- Level
- Definition
- Response

**Rows:**

**0:** Low

**1:** Single endpoint malware contained by EDR, no data loss

**2:** Handle by IT, log in tracker

**0:** Medium

**1:** Compromised account or server, no production impact

**2:** Incident commander engaged, containment within hours

**0:** High

**1:** Production, ERP or OT impact, or suspected data theft

**2:** Activate full team, notify executive sponsor and insurer

**0:** Critical

**1:** Widespread encryption, safety risk or regulated data exposure

**2:** Activate retainer, plant isolation, legal review of notifications

#### 3. First hour actions

**Body:** 1. Call {{hotline}} and name an incident commander ({{ir_lead}}).
2. Record time of discovery, who found it and what was observed. Keep a running log.
3. Do not power off affected machines unless safety requires it; isolate them from the network instead so memory evidence is preserved.
4. Disable affected accounts and rotate privileged credentials from a clean workstation.
5. Notify the plant operations lead ({{plant_lead}}) before any change to OT connectivity.
6. Notify the cyber insurer: {{insurer}}. Check the policy for required notice periods and approved vendors before engaging outside help.
7. Engage the external responder: {{ir_firm}}.

#### 4. Containment of plant floor systems

**Body:** Systems in scope: {{systems}}

Decide with the plant operations lead whether to sever the IT to OT link at the firewall. Cells that can run standalone should be kept running on local programs where safe. Do not change PLC logic or controller settings during an incident without the plant owner and a control engineer present. Keep printed work orders, travelers and schedules available for manual operation. Document each isolation step so it can be reversed in order.

#### 5. Recovery priorities and targets

**Body:** Target restore times: {{rto}}

Restore from known good backups into a clean network segment. Rebuild domain controllers and identity first, then the ERP database, ERP application tier, MES and plant servers. Validate each system with its business owner before reconnecting it. Reset all service account passwords and re-issue certificates where compromise is possible. Do not reconnect OT until the segment has been reviewed.

#### 6. Communications and notifications

**Table:**

**Columns:**

- Audience
- Trigger
- Owner
- Timing target

**Rows:**

**0:** Employees

**1:** Any High or Critical incident

**2:** Communications lead

**3:** Same shift

**0:** Customers and suppliers

**1:** Delivery impact or shared data exposure

**2:** Communications lead and sales

**3:** Per contract terms

**0:** Insurer

**1:** Suspected High or Critical incident

**2:** Incident commander

**3:** As required by policy

**0:** Regulators and government customers

**1:** Regulated data or contract clause applies (for example DFARS cyber incident reporting)

**2:** Legal and compliance

**3:** Per regulation or contract; confirm with counsel

**0:** Law enforcement

**1:** Extortion or criminal activity

**2:** Legal and compliance

**3:** Per counsel advice

#### 7. After the incident

**Body:** Hold a blameless review within two weeks. Record timeline, root cause, what worked, what failed and corrective actions with owners and due dates. Update this plan and the contact list. Preserve logs and evidence as directed by legal counsel.

#### Approval

**Signatures:**

- Incident commander
- Plant operations lead
- Executive sponsor

**Notes:** This is a starting point, not legal advice. Notification deadlines vary by contract, jurisdiction and regulation; confirm them with counsel and your insurer. Replace the sample names, phone numbers and recovery targets with your own, and test the plan in a tabletop exercise.

## Content

**Intro:** An incident response plan is only useful if the plant floor is in it. This template gives a manufacturing IT security lead a complete structure covering roles, severity, first-hour steps, OT containment, recovery order and communications.

**Sections:**

#### How to fill in the template

**Body:** Start with the people. Name an incident commander and a deputy, a plant operations lead who can authorize production decisions, and an executive sponsor. Then list the critical systems and agree on realistic restore targets with the plant, not just IT. Fill in phone numbers and the insurer's claims line, because those are the details nobody can find at 2 a.m. Export to Word to adapt wording, or to PDF to distribute. Store a printed copy in the control room and offsite, since the network may be down when you need it.

**Bullets:**

- Name deputies for every role
- Print copies and keep them offline
- Agree restore targets with plant leadership

#### Structure behind the plan

**Body:** The sections follow the familiar lifecycle used in NIST SP 800-61 and ISO/IEC 27035: preparation, detection and analysis, containment, eradication and recovery, and post-incident review. The manufacturing addition is the plant floor: decisions about isolating IT from OT, keeping safe cells running, and avoiding changes to controller logic without a control engineer. That is where generic templates fall short and where most real confusion happens.

#### Common mistakes

**Body:** Plans fail when they assume email works, when contacts are out of date, when nobody has authority to shut the link to the plant, or when recovery order was never agreed. Another frequent gap is reporting duties to customers or government contracts that arrive in flow-down clauses. Review the plan after every reorganization and run a tabletop at least once a year.

**Bullets:**

- Do not store the only copy on the network it protects
- Decide in advance who can order a plant isolation
- Check customer contracts for incident notice clauses
- Rehearse with real scenarios such as encrypted ERP servers

**Cta:** If you would like help turning your ERP and plant documentation into searchable recovery runbooks that stay on your own servers, Netray can discuss it. The template is free to use as is.

**Faq:**

#### Is this plan suitable for a small plant with one IT person?

**Answer:** Yes. Combine roles where you must, but still name a backup for each. The value is in having decisions and contacts written down before an incident. Trim sections that do not apply and keep the first-hour actions short and clear.

#### Should the plan say whether we pay a ransom?

**Answer:** It should say who decides and what must be checked first, such as legal review, sanctions screening and insurer consent. This template assigns that decision to the executive sponsor and does not take a position on payment.

#### How often should we test it?

**Answer:** At least yearly with a tabletop that includes plant and executive leaders, and after major changes to systems or staff. Update contact details quarterly, because outdated phone numbers are one of the most common failures.

#### Does it satisfy a framework or insurer requirement?

**Answer:** It covers the content most frameworks and insurers expect, but meeting a requirement depends on your evidence, testing and specific wording. Check your policy and contract terms and have counsel review notification clauses.

## Search terms

incident response plan template, cyber incident response plan template manufacturing, ransomware incident response plan, OT incident response plan template, IR plan template word, cybersecurity incident response plan example, incident response plan for manufacturing plant

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json