How do I write an incident response plan for SOC 2?
What an Incident Response Plan Needs
Your SOC 2 incident response plan (IRP) maps to CC7.3-CC7.5 in Trust Services Criteria. Auditors check that you have a documented process for handling security incidents — and that your team follows it.
The Five Sections
| Section | What to Include |
|---|---|
| 1. Detection | How incidents are identified (monitoring tools, customer reports, automated alerts) |
| 2. Classification | Severity levels and criteria (P1 = data breach, P2 = service outage, P3 = minor issue) |
| 3. Response | Who gets notified, what actions they take, escalation path |
| 4. Communication | How you notify affected customers, internal stakeholders, and regulators if required |
| 5. Post-incident review | Root cause analysis process, timeline for review, lessons learned documentation |
A Startup-Sized Example
Detection
"Security events are detected through Sentry error monitoring, AWS CloudWatch alarms, and PagerDuty alerting. Customers can report issues to security@company.com."
Classification
- P1 (Critical): Confirmed data breach, unauthorized access to customer data
- P2 (High): Service outage affecting customers, credential compromise
- P3 (Medium): Failed authentication attempts, minor configuration issues
Response
"P1: CTO notified within 15 minutes via PagerDuty. Affected systems isolated. Investigation begins immediately. P2: On-call engineer responds within 1 hour. P3: Tracked in Linear, addressed within 5 business days."
Communication
"Affected customers notified within 72 hours for P1 incidents. Status page updated for P2+ incidents."
Post-Incident Review
"Post-mortem document created within 5 business days. Team reviews root cause, timeline, and preventive measures. Document stored in Notion."
Tips
- Keep it realistic. If your team is five people, don't describe a Security Operations Center rotation.
- Name your tools. PagerDuty, Sentry, Slack #incidents — auditors want specifics.
- Test it. Run a tabletop exercise once before your audit so you can tell the auditor you've tested the plan.