Share
Author
In this article
It’s 2am. A ransom demand has landed, with a note detailing the payment needed to unlock your systems. Up to four regulatory clocks may already be running, each one a deadline to report the incident within days. And the IT manager named in the incident response plan you downloaded last year? He left back in March.
Most incident response plans online are free downloadable templates: HIPAA-shaped generic documents built for the US, or thin checklists that say “notify relevant authorities” and then list a few bodies, with no indication of who to notify, when, or in what order.
Most do not even attempt to map all the relevant Australian notification deadlines at once. And it makes little sense to apply the same plan to a 40-person accounting firm and a 300-person mining services contractor.
Key takeaways
- A single Australian cyber incident can start several notification clocks at once: the ASD ransomware-payment report (72 hours), the OAIC’s 30-day breach assessment, APRA’s 72-hour rule and SOCI’s 12-hour window. Which ones apply depends on who you are.
- A plan that survives a 2am activation names real people rather than job titles, pre-authorises the urgent calls, and keeps an offline contact card and an out-of-band channel for when your systems are down.
- A generic template is only a starting point. Tailor it by sector, by size, by your Microsoft 365 licensing, and by what your cyber insurance policy requires before you call anyone.
- Detection is the weak point: 39% of the ransomware victims the ASD handled in 2024 to 2025 only found out when the ASD contacted them, and just 32% of Australian organisations say they are actually ready to respond.
- A plan you have never tested is a theory. Run a tabletop exercise at least annually, and quarterly if you are in medical, legal or financial services.
When it comes to the “most wishlisted” cyber security documents and processes, a properly structured incident response plan sits near the top, so in today’s article we’ve put the foundational template together to get you started on the right track. We walk through the full plan, then explain how you would customise it for your business, your industry, your Microsoft 365 environment, and even your insurance policy.
But some brief house-keeping first. So we’re clear what we’re dealing with… a cyber incident response plan is a documented, tested set of decisions, roles and actions a business follows should a cyber incident occur. It deals with detection, containment, removal and recovery, along with the notification obligations that apply to specific industries and business sizes.
The Four Clocks That Start Before You Have Finished Reading the Ransom Note
The single most under-appreciated fact about responding to a serious incident in Australia is that one event can start several regulatory clocks at once, and they do not wait for each other. Which ones apply depends entirely on who you are, but a business can find itself inside all four of these windows simultaneously.
The ASD ransomware payment report (72 hours)
If your business has an annual turnover above $3 million and a ransom or cyber extortion payment is made, by you or on your behalf, you must report that payment to the Australian Signals Directorate through ReportCyber within 72 hours.
This obligation comes from the Cyber Security Act 2024 and has been in force since 30 May 2025. The civil penalty for failing to report is roughly $99,000 for a company. The penalty attaches to the silence, not to the payment itself.
The OAIC assessment (30 days)
If you are an APP entity under the Privacy Act, and most mid-market businesses are, section 26WH requires you to carry out a reasonable and expeditious assessment of a suspected eligible data breach.
The clock starts from the moment you have grounds to suspect, not from the moment you confirm. In Australian Information Commissioner v Australian Clinical Labs (No 2) [2025] FCA 1224, $800,000 of the $5.8 million penalty was specifically for failing that assessment, and the Court was blunt that the standard is measured in “days and short weeks, not months”.
The APRA notification (72 hours)
If you are APRA-regulated, or a material service provider to an entity that is, CPS 234 requires you to notify APRA of a material information security incident within 72 hours of becoming aware of it. From 1 July 2025, CPS 230 extends operational-incident notification further and pushes incident-response obligations down into the contracts APRA-regulated entities hold with their IT providers.
The SOCI report (12 or 72 hours)
If you are a responsible entity for a critical infrastructure asset, the Security of Critical Infrastructure Act sets a 12-hour window for incidents with a significant impact on availability and 72 hours for others. One important nuance for mining services: general mining is not a standalone SOCI sector, so this clock is a checkpoint in your plan to confirm against your specific assets, not a blanket assumption.
The reason these clocks matter for the plan, rather than just for your lawyer, is detection. Among the 138 ransomware incidents the ASD responded to in 2024 to 2025, 39% were identified only because the ASD contacted the victim (ASD Annual Cyber Threat Report 2024-25).
More than one business in three did not know it had been hit. Every one of these deadlines assumes you can detect the incident in the first place, which is exactly what an incident response plan, backed by the right logging, is built to make possible.
💡 Expert Insight: Ashish Srivastava, Head of Cyber Security & Strategy
The pattern we often see in a ransomware event where personal information may have been exposed, and the business is weighing whether to pay. Three clocks can start within the same hour. Having handled these incidents before, and with the expert resources we have at TechBrain, we work to set sequence rather than reacting to clock conflicts.
Step one is always containment, stopping any further spread or impact of the incident, regardless of which regulatory clock is running. In parallel, we treat it as a “personal information may be involved” scenario, well before we’ve confirmed the extent of the breach.
That’s what starts the 30-day OAIC clock on time, rather than waiting for certainty. The ASD payment clock only becomes relevant if and when a payment decision is actually made, and that decision sits with the board, not with IT. Acting as the client’s vCISO, we also bring the insurer in early to confirm what forensic assistance is available to us under their panel, before any vendor is engaged.
The four clocks at a glance:
- Ransomware payment report: a business with turnover above $3M that makes a payment; 72 hours; to ASD via ReportCyber.
- OAIC breach assessment: APP entities; 30 days to assess, from suspicion; to OAIC, then affected individuals.
- APRA CPS 234 notification: APRA-regulated entities and their material providers; 72 hours; to APRA.
- SOCI incident report: responsible entities for critical infrastructure assets; 12 hours (significant availability impact) or 72 hours; to ASD.
The Six Phases of Incident Response, in the Language Your Regulator Speaks
Most international frameworks describe the same lifecycle in slightly different words. We anchor our template to the six-phase model the ASD uses, Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned, for one practical reason: the regulator you may have to report to within 72 hours already speaks this language, and you do not want to be translating frameworks at the worst possible moment.
The 2025 rewrite of the NIST incident response guidance (SP 800-61r3) deliberately stepped back to a management-level view, so we map to it rather than structure around it, and we draw the formal severity step from ISO/IEC 27035.
That severity step is the one most templates skip, and it is worth singling out. Between identifying something is wrong and containing it, a named decision-maker should make a deliberate severity call before any costly response action is authorised. This is the gate that stops ransomware being triaged as a routine IT ticket, and stops an unclicked phishing email from triggering a full production shutdown. It is the difference between a measured response and an expensive reflex.
One boundary worth drawing clearly: this article is about managing the incident itself. Restoring systems and data afterwards is disaster recovery, a related but distinct discipline. Rather than repeat it here, we cover it in our guide to building a cyber attack disaster recovery plan.
- Preparation: plan, roles, logging and retainers in place before anything happens.
- Identification: detect and confirm that something is wrong.
- Assess & Decide gate: a named decision-maker sets the severity before any response action is authorised.
- Containment: isolate affected systems; notification clocks can start here.
- Eradication: remove the attacker and close the access vector.
- Recovery: restore validated systems in order of business criticality.
- Lessons Learned: hold a blameless review, then update and re-approve the plan.
Your Incident Response Plan Template, Section by Section
Each section of this template must be copied and completed as required. The plan must be sufficient for a tired person to follow at 2am; it doesn’t have to be beautiful to impress an auditor. Replace every bracketed field with your own detail.
1. Governance and sign-off.
Without board or executive sign-off, anyone can override the plan mid-incident. Document owner, version, last reviewed and next-review dates, and the board, CEO or Managing Director who approved it.
2. Scope and activation criteria.
Triggers a non-specialist can recognise, not “activate when an incident occurs”. For example: a ransom note appears on any device; an EDR alert flags lateral movement across two or more endpoints; a staff member reports credentials entered on a suspected phishing site; the bank flags a fraudulent transfer. Name who can activate the plan, including after hours.
3. Severity matrix.
This decides who gets woken up. Print it and keep it on page one.
4. Roles and decision authority.
Name humans, not job titles. “The IT team” is one panicking person at 2am. Incident Commander (with a named backup), Technical Lead, Communications Lead, Legal/Privacy, and Executive Sponsor, each with a mobile number. Pre-authorise the time-critical calls: isolating a production system, suspending user accounts, engaging the forensic retainer. A decision to pay a ransom is reserved for the board or executive, and remember the 72-hour report if a payment is ever made.
5. Out-of-band communications.
The first thing ransomware takes down is the way you normally talk to each other. A pre-built channel that does not live on the infrastructure under attack (for example a named Signal group on personal phones), a conference bridge or war-room number, and a quarterly test.
6. Printed contact card.
Stored offline, because the network share may be encrypted. Cyber insurer 24/7 claims line (your first call); ASD / ReportCyber on 1300 CYBER1 (1300 292 371), cyber.gov.au/report; OAIC on 1300 363 992; legal counsel after-hours; forensic / IR retainer; and key vendors (ISP, hosting, Microsoft partner).
7. Scenario playbooks.
The three incidents most likely to hit an Australian mid-market business each earn a one-page playbook: ransomware, business email compromise, and data breach or exfiltration. Each covers the trigger, the first 15 minutes, what to preserve, and who to notify.
8. Evidence preservation.
Reimaging a compromised server destroys the evidence your insurer and the OAIC will later ask for. Contain by isolating affected hosts from the network rather than wiping them; image systems before rebuilding them; capture sign-in logs and OAuth app grants before revoking sessions and rotating credentials; and keep a chain-of-custody log. For the discipline behind this, see our explainer on the fundamentals of cyber forensics.
9. Notification decision tree.
The four clocks, as a set of yes/no gates. Personal information likely exposed and serious harm possible, and you are an APP entity? Start the 30-day OAIC assessment now. Ransom payment made and turnover above $3 million? Report to ASD within 72 hours. APRA-regulated or a material provider to one? Assess materiality and notify APRA within 72 hours. Responsible entity for a critical infrastructure asset? Apply the 12 or 72-hour SOCI window.
10. Recovery gate and post-incident review.
Restoring into a still-compromised environment simply restarts the incident. Do not restore until the access vector is closed and backups are validated as clean; restore in order of business criticality; and hold a blameless review within two weeks, capturing root cause and the gaps the plan did not cover, then update and re-approve the plan before closing the file.
A note on responsibility
This template is a guide to help you build your own incident response plan. It is not legal advice, and it does not replace advice specific to your business. Your incident response plan, and compliance with the obligations that apply to you, remain your organisation’s responsibility.
We have flagged the major Australian obligations as at 2026, but you should confirm what applies to you with your own legal and compliance advisers.
💡 Expert Insight: Ashish Srivastava, Head of Cyber Security & Strategy
Most downloaded or inherited plans jump straight from “detected” to “contained,” with responsibility never actually assigned in between. This gap is where most plans fail in practice, either through delayed action, under-reaction, or in some instances, over-reaction.
We recommend a planned and tested pre-authorisation to isolate a production system, but only when three things are true together.
First, the system sits behind a documented Business Impact Analysis at a critical rating, so whoever makes the call knows what they’re taking offline. Second, there’s a named technical alternative or manual fallback for the business function that system supports. Third, the authority is time boxed, meaning the person can isolate immediately but must brief the Incident Commander within a set window, not after the fact.
Without those three guardrails in place, pre-authorisation doesn’t remove the panic, it just moves it from 2am to the debrief.
How To Tailor The Template To Your Business
A downloaded template is a starting point. The value is in the tailoring, and there are four axes that matter most.
By sector
The obligations and the priorities shift markedly by industry.
Medical: health service providers are covered by the Privacy Act regardless of turnover. Add My Health Record obligations, a patient-safety assessment step with a paper-based fallback if clinical systems go down, and put clinical systems first in your recovery order.
Mining services: the obligations that bite are usually contractual rather than SOCI. Tier-1 miners publish supplier cyber requirements, often with notification windows of 24 to 48 hours. If you run operational technology such as SCADA, it needs a separate containment track, because isolating IT does not isolate OT, and isolating OT without operations sign-off can create a physical safety risk.
Detection is the sector’s weak point: OAIC data analysed by Secolve under freedom-of-information and reported in November 2025 found mining and manufacturing breaches taking up to two years to detect.
Legal: legal professional privilege shapes the whole response, so engage external cyber counsel before the forensic team begins documenting findings. Add a trust account integrity check to early containment. From 1 July 2026, AML/CTF reform also brings many firms under Privacy Act obligations for their AML/CTF-related data.
Accounting and tax: Tax Practitioners Board quality-management obligations apply from July 2025, exposure of tax file numbers makes the serious-harm threshold for notification more likely to be met, and the plan should set tighter recovery targets around BAS and end-of-financial-year deadlines. From 1 July 2026, AML/CTF reform also brings many practices under Privacy Act obligations for their AML/CTF-related data.
Real estate: trust accounts and business email compromise targeting settlement funds are the scenario to plan for, and AML/CTF reform brings many agencies under Privacy Act obligations for their AML/CTF-related data from 1 July 2026, the month this guide is published.
Wealth management and insurance: ASIC v FIIG Securities [2026] FCA 92, a $2.5 million penalty and the first Federal Court civil penalty for cyber security failures under general AFS licensee obligations, makes a tested incident response plan part of the licence baseline. APRA-regulated readers add the CPS 234 and CPS 230 gates.
By size
Within the 20 to 500-seat range, the decisions do not change, but the number of people making them does.
- 20 to 60 seats: the owner is both Incident Commander and Executive Sponsor wearing different hats, and the technical lead is usually your managed service provider. The plan should state the boundary explicitly: what your provider detects and contains, and what the business itself must decide. Pre-authorised thresholds matter most here, because one person cannot phone a committee at 2am.
- 60 to 200 seats: real role separation begins, a compliance owner takes the OAIC assessment, and the playbooks multiply with the attack surface.
- 200 to 500 seats: this is programme discipline, with vCISO ownership, shift coverage for sustained incidents, a vendor-incident workflow, and metrics such as time to detect and time to contain tracked against a baseline.
By Microsoft 365 licensing
The plan quietly assumes evidence your default licensing may not actually be keeping. Entra ID sign-in logs are retained for 30 days, and only 7 on the free tier. Standard Microsoft 365 audit logs run to 180 days. Proving which emails an attacker read during a business email compromise needs Purview Audit (Premium), an E5-tier capability that cannot be switched on retroactively, and most mid-market tenants run on Business Premium.
The fix is to centralise logging into a SIEM before an incident, not after. We cover the platform choices in XDR vs SIEM vs SOAR and deliver it as a managed SIEM service.
By insurance policy
This is the axis most plans ignore, and it carries real cost.
Many Australian cyber policies only cover response costs incurred without the insurer’s consent inside a short window, commonly 72 hours, and then mandate vendors from an approved panel. The forensic firm you instinctively call first may not be a covered one. Tailor the plan to the policy: put the insurer’s hotline first on the contact card, write the panel-vendor list into the plan, and resolve any conflict between your preferred responders and the insurer’s panel before an incident.
One caveat worth stating in the plan itself: a statutory clock does not pause while you wait for a claims line, so a 12-hour SOCI window cannot be spent on hold. If you want help aligning the two, our cyber insurance advisory exists for exactly this.
An Untested Plan Is a Theory
There is a big difference between feeling ready to handle a cyber security incident and actually being ready to handle a cyber security incident. The Datacom Cybersecurity Index published in June 2026 reported that 75% of Australian organisations surveyed stated they have good visibility of their cyber risk, however only 32% of organisations stated they are ready to respond to a cyber security incident.
Yes, there is international evidence to show that organisations with tested incident response plans and trained incident response teams in place experience lower breach costs than those without. However these figures are heavily weighted towards the enterprise sector and should be treated as directional only for your business.
You don’t have to spend an absolute fortune to test your plan. An annual (or quarterly for medical, legal or financial services) tabletop exercise is a great place to start: walk through a scenario step by step (the difficult bits such as notification as well as the rest), then test out the bits that you suspect will fail silently (such as a contact tree, out-of-band notification channel and hotline number for your insurer), and then amend your plan after an incident or test, after significant changes in technology or people, after changes in rules and regulations that affect you, and lastly annually in any case.
We provide exactly this in our incident response training.
How TechBrain Helps
We build, test and maintain incident response capability for Australian mid-market organisations, anchored to our ISO 27001-certified, sovereign Australian delivery, and scoped to the regulatory profile of sectors such as mining services, medical, legal, accounting, real estate and wealth management.
- Incident response planning: we design, build, test and maintain plans aligned to ASD guidance and the obligations in this article.
- Incident response training: facilitated tabletop exercises that turn the document into a team that can use it.
- Managed SOC: 24/7 sovereign detection and response, staffing the identification and containment phases.
- Managed SIEM: the log retention and evidence backbone the template depends on.
- TechSure cyber risk assessment: the preparation-phase gap analysis that shows which template sections need the most work.
- Essential Eight assessment: Maturity Level Two expects an enacted incident response plan, so this shows where you stand.
For formal digital forensic investigation to a legal evidentiary standard, your plan’s escalation path should name a specialist DFIR firm. We help clients build that escalation path and preserve the evidence those specialists will need.
Ready to put your plan to the test? Get your current incident response plan in front of someone who responds to incidents for a living. Get in touch to book an initial review against the obligations in this article.
Disclaimer: This article is general information, current as at 2026, and is not legal or compliance advice. Regulatory obligations change and depend on your specific circumstances. Your incident response plan and your compliance obligations remain your organisation’s responsibility. Confirm what applies to you with your own legal and compliance advisers.
Sources
- ASD Annual Cyber Threat Report 2024-25, Australian Signals Directorate.
- Datacom Cybersecurity Index 2026, reported by iTnews, June 2026.
- Notifiable Data Breaches scheme, Office of the Australian Information Commissioner (Privacy Act 1988, s 26WH).
- Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224, Federal Court of Australia.
- ASIC v FIIG Securities Limited [2026] FCA 92; ASIC media release 26-021MR.
- Cyber Security Act 2024 (Cth), ransomware payment reporting; see Allens, New cyber incident response obligations for Australian organisations.
- APRA Prudential Standards CPS 234 (Information Security) and CPS 230 (Operational Risk Management).
- Security of Critical Infrastructure Act 2018 (Cth).
- NIST SP 800-61r3, Incident Response Recommendations and Considerations.
- ISO/IEC 27035-2:2023, Information security incident management.
- Delays detecting data breaches in Australian mining and manufacturing, ABC News (OAIC data analysed by Secolve under FOI, November 2025).
- Microsoft Entra ID data retention reference.
- TrustedSec, MailItemsAccessed: M365 investigation challenges.
- IBM Cost of a Data Breach Report 2024.
- Cyber insurance response-cost conditions: MIPS Cyber Policy, AU; CFC and Corvus incident-response guidance.
