What it is
When credentials are stolen or a laptop is lost, the first hours decide how bad it gets. A plan names who leads, who contains, who calls counsel and the insurer, and what has to be preserved.
This plan sets definitions, the response team, eight phases from detection to lessons learned with owners and target times, a notification decision table covering clients, regulators, the FTC, the IRS Stakeholder Liaison and state tax agencies, an incident log and a tabletop test.
When to use it
- Writing the incident response plan the security program calls for.
- After a tabletop exercise exposes gaps.
- Before cyber insurance renewal.
What’s inside
- Definitions and team table with backups
- Eight response phases with owner and target time
- Notification decision table
- Communications rules, incident log and testing schedule
Standard cited
This template follows 16 CFR 314.4 / IRS Pub. 4557. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Who must be told about a breach?
It depends on the data, the people affected, state law, the FTC Safeguards Rule for covered firms, contracts and insurance terms. The plan sets out who to consider and who decides, and tells you to involve counsel.
Why contact the IRS after tax data theft?
The IRS Stakeholder Liaison program asks tax professionals to report data theft so it can protect taxpayers’ accounts. State tax agencies ask for the same.
How often should the plan be tested?
At least yearly with a tabletop exercise. The plan has a place to record the scenario, participants and fixes.
Related templates
- Written Information Security Plan (WISP) for CPA Firms
- Security Incident Log and Notification Tracker (Excel)
- Business Continuity and Disaster Recovery Plan for CPA Firms
- Backup, Disaster Recovery and Incident Response Checklist
Last updated 11/05/2026. All free templates.