An incident response plan answers a question that tends to arrive at a bad moment: when something goes wrong on the network, who does what, and in what order? CyberSecurity Malaysia’s MyCERT counted 2,715 reported incidents in Q2 2026, up from 2,188 in the first quarter, so the question comes up regularly for Malaysian organizations.
The plan matters most for what it takes out of the moment. Without one, early time goes on deciding who is in charge, who may speak to the press and whether a regulator has to be told. With one, those decisions are already made, and the people involved can spend their time on containment. For a large enterprise with several teams, vendors and legal duties, the stakes are higher. The Personal Data Protection Commissioner’s circular sets a 72-hour deadline for the information a breach notice must carry, so the plan has to be written, approved and tested before it is needed.
This guide covers what an incident response plan is, the roles on the response team and the steps the plan should contain. It then sets out the Malaysian reporting duties that start a clock and shows how to test the plan in a tabletop exercise.
What Is an Incident Response Plan?
An incident response plan is a written procedure for detecting, containing and recovering from a cyber incident. The standard reference is the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61 Revision 3, published in April 2025, which replaces Revision 2 and aligns incident response with Cybersecurity Framework (CSF) 2.0.
The plan sits between policy and playbooks. NIST recommends policies that govern incident response, playbooks that document common procedures and business continuity plans that stay in step with the response plan. In our reading, the plan is the layer that says who decides and in what order, while the playbooks hold the technical detail for specific incident types. Our guide to business continuity and disaster recovery explains how the two fit together.
The US Cybersecurity and Infrastructure Security Agency (CISA) adds two practical points. The senior leadership team should formally approve the plan, and, because an attack can lock the systems that store it, CISA’s ransomware guide advises keeping a hard copy and an offline version.
Which Roles Does the Response Team Need?
A response team needs at least three assigned roles: an incident manager, a technical lead and a communications lead, according to CISA’s Incident Response Plan Basics. The incident manager leads the response, manages communication flows and delegates tasks, but performs no technical work, which keeps one person free to see the whole incident. The technical lead is the subject matter expert and brings in internal or external technical experts with the incident manager’s consent. The communications lead handles reporters, social media and some external stakeholders. NIST adds that all roles and responsibilities for incident response should be documented.
We recommend three more seats at the table. Legal counsel reviews the plan, as CISA advises, and guides decisions about outside vendors, law enforcement and notification duties. The data protection officer (DPO) supplies the contact details that a breach notice must carry and helps assess harm to individuals. Third-party providers, such as managed security, cloud and backup providers, need their responsibilities defined in the contract, as NIST says.
Name a deputy for every role and list a phone number for each person. CISA advises using out-of-band communication, such as phone calls, during a ransomware incident, so the contact sheet should hold numbers that work without the network.
What Steps Should the Plan Contain?
An incident response plan should contain six steps, and NIST’s SP 800-61 Revision 3 and CISA’s ransomware response checklist describe each of them:
- Detect and verify.
- Prioritize by risk.
- Contain.
- Eradicate and recover.
- Notify.
- Review.
Detection comes first, and verification comes straight after it: NIST says incident handlers confirm that an incident has occurred and analyze the evidence before the response widens. Prioritization follows. NIST says incidents should not be handled on a first-come, first-served basis, so the plan should say how to rank them by business impact. A server that holds customer data outranks a lab machine.
Containment is where speed matters most, because it prevents the incident from expanding. CISA’s ransomware guide advises isolating the affected systems and, when several subnets look affected, taking the network offline at the switch level. It says to power devices down only when disconnecting is impossible, since shutting down erases volatile memory that may hold evidence.
Recovery restores from clean, offline, encrypted backups, and NIST says to check each restored asset for indicators of compromise before it returns to production. CISA adds that the plan should record which data and systems matter most, so the team knows what to bring back first. Endpoint detection and response (EDR) speeds both steps by monitoring endpoints, detecting attacker behavior and containing infected devices, and immutable backup keeps copies that attackers cannot alter.
Notification runs alongside the technical work. NIST advises regularly updating senior leadership on major incidents and following the organization’s breach notification procedures when a data breach occurs; the next section sets out the Malaysian clocks. The last step is a blameless retrospective, as CISA requires, and an after-action report that documents the incident, the response and the lessons learned, as NIST recommends. The plan then changes to reflect what the team learned.
Which Malaysian Reporting Duties Start the Clock?
Two Malaysian regimes set reporting clocks: the Personal Data Protection Commissioner’s breach notification circular and, for operators of national critical information infrastructure (NCII), the Cyber Security Act 2024. Under the circular, a data controller must notify the Commissioner as soon as practicable after a personal data breach that causes or is likely to cause significant harm. The required information is due within 72 hours of the breach, and further details can follow in stages, no later than 30 days after the first notice. Affected individuals must be told within 7 days after the Commissioner.
The Cyber Security Act 2024 (Act 854) came into force on 26 August 2024, according to the National Cyber Security Agency (NACSA). The law firm CMS reports that it covers NCII entities in 11 sectors. The law firm HHQ reports that an NCII entity gives initial notice immediately after discovery, then a detailed report within 6 hours and supplementary details within 14 days. Notices go to the Chief Executive of NACSA and the NCII sector lead.
The two firms read the starting point of the 6-hour clock differently: HHQ counts from discovery, and CMS counts from the initial notice. This is general information, not legal advice.
Any organization can also report an incident to CyberSecurity Malaysia’s Cyber999 service at cyber999@cybersecurity.my. The phone line, 1-300-88-2999, is monitored Monday to Friday, 8:30 am to 5:30 pm, and the mobile line, +6019-2665850, takes 24×7 calls.
How Do You Run a Tabletop Exercise?
A tabletop exercise is a discussion-based session where team members talk through their roles and responses to a simulated cyber incident. The UK National Cyber Security Centre (NCSC) describes the format in its 2020 guidance, and NIST lists tabletop discussions among the exercise types that help evaluate an incident response program. The exercise should test the existing plan rather than invent a new one, so it finds the gaps while a gap is still cheap to fix.
The steps below adapt the NCSC’s guidance. Begin with the objective: decide which part of the plan to test, such as containment or breach notification, and write one measurable aim. Then choose the participants, who should include the incident manager, technical lead, communications lead, legal counsel, the DPO and the third parties named in the plan.
The scenario carries the exercise. Build a storyline, then write the injects, the pieces of new information released during play, and open with an exercise announcement so nobody mistakes the session for a real incident.
Example scenario: the helpdesk reports that file shares are locked and a ransom note sits on a finance server. The first inject asks who isolates the server. The second reveals that the server holds customer identity numbers, which tests the 72-hour breach clock. The third reports that the backup server is also encrypted, which tests recovery.
During the session, the facilitator releases each inject, asks who does what, and records decisions and timings. Straight afterward, hold a hot-wash to collect feedback and observations while memory is fresh. Then write the after-action report, record the lessons and recommendations with a named owner for each, and fix the plan before the next exercise.
CISA publishes Tabletop Exercise Packages with a situation manual, a facilitator and evaluator handbook, a slide deck and an after-action report template. Its ransomware scenarios cover industrial controls, a third-party vendor and vendor phishing. For those who wish to learn more, our guide to disaster recovery testing covers the recovery-focused version of the exercise.
Where Should a Malaysian Enterprise Start?
A Malaysian enterprise should start by naming its incident manager, listing notification contacts and agreeing the first containment actions, then test that draft in a tabletop exercise. In our view, a short plan that staff can find during an incident is more useful than a long plan nobody reads. Work through this order:
- Name the roles, with deputies, and have senior leadership approve the plan.
- Write the contact sheet: internal and vendor contacts, the DPO, the Commissioner and Cyber999, and the NACSA and sector lead contacts if you operate NCII. Keep a hard copy and an offline version.
- Map the clocks the circular states (72 hours, 7 days and 30 days) and the NCII deadlines, where they apply, on one page.
- Prepare recovery: an offline, encrypted backup, a tested restore and a list of which systems come back first.
- Run the first tabletop with a ransomware scenario and fix the gaps it exposes.
- Review the plan quarterly, as CISA recommends, and again after any major incident or system change.
Talk to Our Team
A tabletop exercise shows whether the plan works on paper. Whether the tools behind it work, such as endpoint detection containing an infected device or a backup restoring cleanly, is a separate check, and our cybersecurity protection service covers it with endpoint detection and response and with secure backup and disaster recovery. To compare your draft plan with your real setup, book a free consultation.
