---
title: "Incident response plan outline"
url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-incident-response-plan"
type: "precedent"
site: "AI Law Framework"
id: "a25-us-incident-response-plan"
area_id: "A25"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A25-T1-R4", "A25-A20260923-4"]
law_stated_as_at: "2026-10-22"
---

# Incident response plan outline

> An outline for a written incident response plan, arranged on the six functions in NIST SP 800-61r3. A Safeguards Rule plan is a separate box, and only if that rule applies.

Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-incident-response-plan  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md)
- Jurisdictions: United States
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the 4 authorities it cites, for United States.

## When to use it

Use when the organization is writing or revising how it will handle a cyber incident. It is not the notice to individuals. It does not decide that any statute requires this plan.

## Used for these tasks

- [Draft a data-breach incident response plan](https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-data-breach-incident-response-plan.md)
- [Build a 48-hour incident chronology from the tickets and emails](https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-48-hour-incident-chronology-from-the-tickets-and-emails.md)

## How AI may be used

AI may arrange the lawyer's systems and roles under the six functions. The lawyer decides whether 16 CFR part 314 applies and what the plan requires the organization to do.

**AI may:**

- Place the systems and the names the lawyer supplies under the function the lawyer marks
- Keep the Safeguards Rule box separate from the NIST outline
- Flag a deadline for notice to individuals that this plan does not contain

**AI must not:**

- Must not treat NIST SP 800-61r3 as a statute that binds a private organization
- Must not apply 16 CFR § 314.4(h) unless the lawyer has decided part 314 applies
- Must not draft the notice to individuals or a statement to a regulator

**The lawyer checks:**

- The plan names roles, not a generic security team with no owner
- Part 314 is ticked only after the lawyer reads § 314.1 against the business
- Notice deadlines live in the breach-notice letter, not in this outline

## Authorities

- [NIST SP 800-61r3 (April 2025), Incident Response Recommendations and Considerations for Cybersecurity Risk Management, a CSF 2.0 Community Profile](https://doi.org/10.6028/NIST.SP.800-61r3)
- [16 CFR § 314.1(b) (who the Safeguards Rule addresses)](https://www.law.cornell.edu/cfr/text/16/314.1)
- [16 CFR § 314.4(h) (what a written incident response plan under that rule must cover)](https://www.law.cornell.edu/cfr/text/16/314.4)
- [FTC, Data Breach Response: A Guide for Business (operational steps; not a notice deadline)](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-incident-response-plan and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*