Publication - Advice and guidance

Cyber incident response toolkit

Last updated: 22 December 2025 - see all updates
Directorate: Safer Communities Directorate
Topic: Business, industry and innovation, Public safety and emergencies, Public sector

Cyber incident response toolkit to help organisations develop plans for responding to the threat of cyber attacks.

Part of

The cyber incident response toolkit has been created to help organisations manage their cyber incident response.

The toolkit (attached) contains:

a model public sector incident response plan template
a set of playbooks covering data loss, denial of service, malware, phishing and ransomware
a cyber incident assessment tool designed to provide high level insight into the organisation's maturity across a range of related incident management controls

The toolkit will be subject to constant review, building on good practice, lessons from exercises and incidents and feedback from public bodies.

First published: 4 October 2019
Last updated: 22 December 2025 - show all updates
All updates: 22 December 2025
All templates updated except for the cyber incident readiness assessment.

13 December 2024
All templates updated and publication renamed to cyber incident response toolkit.

21 July 2021
Replaced data loss, denial of service, malware, phishing and ransomware playbook pdfs with word versions.

Thanks for your feedback