Hello everyone,

I'm charged with coming up with a number of documents for IT's policies and procedures. My background is managing local IT departments for very large companies (for example, a software development center for one of the biggest life insurance companies in the US), but I now work for a very small company that I'm trying to help become more sophisticated.

Right now I'm working on creating a simple Incident Response Plan. The IT department is basically four people, including myself. We can't use a plan template that's far above our level, since much of it will be unsuitable for our structure. So I'm trying to find a template that just talks about the basics. Something to the effect of:

• Identifying a incident
• Responding to an incident
• Mitigating future problems
• Documenting the incident (post mortem, lessons learned, root cause, whatever)

I've been through enough incidents that I could write this myself, but why reinvent what others have done much better, and I don't want to miss anything. I believe using a template that's well though out is always the better approach.

Unfortunately, I'm struggling to find a simple plan that has actual language I can use. SANS' Incident Handling Process for Small and Medium Businesses tells you what to do, but it's not an actual template.

Thanks!