Cyber Incident Response Plan Template for Manufacturers
An incident response plan is only useful if the plant floor is in it. This template gives a manufacturing IT security lead a complete structure covering roles, severity, first-hour steps, OT containment, recovery order and communications.
Fill in
Manufacturing Cyber Incident Response Plan Template
Cyber Incident Response Plan
Organization: Acme Precision Ltd Site: Plant 1, Columbus OH Version: 1.0 Effective: 2026-11-01
Purpose: to define how Acme Precision Ltd detects, contains, investigates, recovers from and learns from cybersecurity incidents affecting business IT, the ERP and plant floor (OT) systems.
1. Roles
| Role | Responsibility | Named person |
|---|---|---|
| Incident commander | Owns decisions, severity, timeline and log | IT Security Lead, J. Rivera |
| Plant operations lead | Decides on production stops, manual operation and safety | Plant Manager, S. Okafor |
| Executive sponsor | Approves major decisions such as ransom policy, shutdowns, public statements | COO |
| Communications lead | Employees, customers, regulators, media | |
| Legal and compliance | Notification duties, evidence preservation | |
| ERP and application owner | Restores ERP and integrations from backup |
2. Severity levels
| Level | Definition | Response |
|---|---|---|
| Low | Single endpoint malware contained by EDR, no data loss | Handle by IT, log in tracker |
| Medium | Compromised account or server, no production impact | Incident commander engaged, containment within hours |
| High | Production, ERP or OT impact, or suspected data theft | Activate full team, notify executive sponsor and insurer |
| Critical | Widespread encryption, safety risk or regulated data exposure | Activate retainer, plant isolation, legal review of notifications |
3. First hour actions
1. Call +1 555 0100 (security on-call) and name an incident commander (IT Security Lead, J. Rivera). 2. Record time of discovery, who found it and what was observed. Keep a running log. 3. Do not power off affected machines unless safety requires it; isolate them from the network instead so memory evidence is preserved. 4. Disable affected accounts and rotate privileged credentials from a clean workstation. 5. Notify the plant operations lead (Plant Manager, S. Okafor) before any change to OT connectivity. 6. Notify the cyber insurer: To be completed (policy number and claims phone). Check the policy for required notice periods and approved vendors before engaging outside help. 7. Engage the external responder: To be completed (retainer provider).
4. Containment of plant floor systems
Systems in scope: ERP database and application servers, MES, quality system, CNC DNC server, active directory, backup server, plant historian.
Decide with the plant operations lead whether to sever the IT to OT link at the firewall. Cells that can run standalone should be kept running on local programs where safe. Do not change PLC logic or controller settings during an incident without the plant owner and a control engineer present. Keep printed work orders, travelers and schedules available for manual operation. Document each isolation step so it can be reversed in order.
5. Recovery priorities and targets
Target restore times: ERP 24 hours, MES 8 hours, DNC 4 hours
Restore from known good backups into a clean network segment. Rebuild domain controllers and identity first, then the ERP database, ERP application tier, MES and plant servers. Validate each system with its business owner before reconnecting it. Reset all service account passwords and re-issue certificates where compromise is possible. Do not reconnect OT until the segment has been reviewed.
6. Communications and notifications
| Audience | Trigger | Owner | Timing target |
|---|---|---|---|
| Employees | Any High or Critical incident | Communications lead | Same shift |
| Customers and suppliers | Delivery impact or shared data exposure | Communications lead and sales | Per contract terms |
| Insurer | Suspected High or Critical incident | Incident commander | As required by policy |
| Regulators and government customers | Regulated data or contract clause applies (for example DFARS cyber incident reporting) | Legal and compliance | Per regulation or contract; confirm with counsel |
| Law enforcement | Extortion or criminal activity | Legal and compliance | Per counsel advice |
7. After the incident
Hold a blameless review within two weeks. Record timeline, root cause, what worked, what failed and corrective actions with owners and due dates. Update this plan and the contact list. Preserve logs and evidence as directed by legal counsel.
Approval
This is a starting point, not legal advice. Notification deadlines vary by contract, jurisdiction and regulation; confirm them with counsel and your insurer. Replace the sample names, phone numbers and recovery targets with your own, and test the plan in a tabletop exercise.
Optional help building ERP recovery runbooks
We can show how private AI over your own documentation can draft and maintain restore runbooks for ERP and plant systems.
Optional. The tool and every export work without this. No spam.
How to fill in the template
Start with the people. Name an incident commander and a deputy, a plant operations lead who can authorize production decisions, and an executive sponsor. Then list the critical systems and agree on realistic restore targets with the plant, not just IT. Fill in phone numbers and the insurer's claims line, because those are the details nobody can find at 2 a.m. Export to Word to adapt wording, or to PDF to distribute. Store a printed copy in the control room and offsite, since the network may be down when you need it.
- Name deputies for every role
- Print copies and keep them offline
- Agree restore targets with plant leadership
Structure behind the plan
The sections follow the familiar lifecycle used in NIST SP 800-61 and ISO/IEC 27035: preparation, detection and analysis, containment, eradication and recovery, and post-incident review. The manufacturing addition is the plant floor: decisions about isolating IT from OT, keeping safe cells running, and avoiding changes to controller logic without a control engineer. That is where generic templates fall short and where most real confusion happens.
Common mistakes
Plans fail when they assume email works, when contacts are out of date, when nobody has authority to shut the link to the plant, or when recovery order was never agreed. Another frequent gap is reporting duties to customers or government contracts that arrive in flow-down clauses. Review the plan after every reorganization and run a tabletop at least once a year.
- Do not store the only copy on the network it protects
- Decide in advance who can order a plant isolation
- Check customer contracts for incident notice clauses
- Rehearse with real scenarios such as encrypted ERP servers
Frequently Asked Questions
Is this plan suitable for a small plant with one IT person?
Yes. Combine roles where you must, but still name a backup for each. The value is in having decisions and contacts written down before an incident. Trim sections that do not apply and keep the first-hour actions short and clear.
Should the plan say whether we pay a ransom?
It should say who decides and what must be checked first, such as legal review, sanctions screening and insurer consent. This template assigns that decision to the executive sponsor and does not take a position on payment.
How often should we test it?
At least yearly with a tabletop that includes plant and executive leaders, and after major changes to systems or staff. Update contact details quarterly, because outdated phone numbers are one of the most common failures.
Does it satisfy a framework or insurer requirement?
It covers the content most frameworks and insurers expect, but meeting a requirement depends on your evidence, testing and specific wording. Check your policy and contract terms and have counsel review notification clauses.
If you would like help turning your ERP and plant documentation into searchable recovery runbooks that stay on your own servers, Netray can discuss it. The template is free to use as is.
Related Tools
Manufacturer Ransomware Readiness Assessment
A 10-question self-assessment that scores how ready a manufacturing site is to prevent, survive and recover from ransomware, including OT and ERP recovery.
Compliance & ContractsCyber Insurance Readiness Checklist for Manufacturers
A checklist of the controls and documents underwriters commonly ask manufacturers about, so you can fix gaps before the application or renewal.
Industry TemplatesOT Asset Inventory Worksheet
An editable inventory of operational technology assets with Purdue level, firmware, support status and a criticality times exposure risk score.
Compliance & ContractsEnterprise Password and Passphrase Policy Template
A fill-in password policy that covers length, MFA, lockout, service accounts and shop floor shared logins, aligned with current NIST thinking.
More Industry Templates tools
See all- OEE Improvement A3 Charter Template
- Customer Order Change Request Form Template
- Plant Network Segmentation Checklist (Purdue Model)
- Server Room UPS Runtime and Sizing Calculator
- Server Room Cooling Load BTU Calculator
- Ransomware Downtime Cost Calculator for Manufacturers
- Plant Switch Port Budget Worksheet
- Industrial Protocol and Plant IT TCP/UDP Ports Reference
- Plant Network VLAN and IP Addressing Plan Worksheet