IR RACI & On-Call Roster Builder
Who does what in an incident, who is on call (with a deputy for every role), and how to reach the outside help you will need — IR retainer, counsel, insurer, PR, regulators and law enforcement. Sample rows are filled in; the summary checks that each activity has exactly one Accountable owner.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
Three tables every incident response plan needs and few keep current: who is Responsible, Accountable, Consulted and Informed for each response activity; who is on call, with a deputy for every role; and the outside parties you will need at 2am — IR retainer, counsel, insurer, PR, regulators, law enforcement. Starts with sample rows for a fictional company. Each activity should have exactly one A; the summary checks that for you.
Your context
RACI by response activity
R = does the work. A = owns the outcome and signs off (exactly one per activity). C = consulted before the decision. I = informed after. Add rows for activities specific to you.
On-call roster with deputies
Every role needs a deputy who has the same access and authority. Keep personal numbers in the printed copy if your policy allows, because work phones may be unreachable in an identity incident.
External contacts
The outside parties a serious incident needs. Record the contract or policy reference so nobody has to search email to prove you are a client. Check with counsel which regulators apply to you.
Keep it working
Every activity has exactly one Accountable person, and that person has the authority the activity needsmaterial
Every on-call role has a deputy with the same access and authority, and deputies have joined at least one exercisematerial
The roster and contact list are available offline or out of band (printed card, secure offline copy), not only in systems an attacker may control
External contacts are tested at least every 90 days: hotline called, reference numbers confirmed, account managers still in post
The RACI and roster are reviewed after every reorganisation, leaver in a named role, and SEV1/SEV2 incident
What this template gives you
- A RACI for incident response activities: declaring, containing, taking services offline, engaging forensics, notifying insurers and regulators, media, attacker contact, return to service and the post-incident review.
- An on-call roster where every role has a deputy and an escalation time.
- An external contacts register with contract and policy references and a "last verified" date.
- Automatic checks: exactly one Accountable per activity, a Responsible for each, deputies named, contacts verified in the last 90 days.
Frequently asked questions
What is a RACI for incident response?
A table that shows, for each response activity, who is Responsible (does the work), Accountable (owns the outcome and signs off), Consulted (asked before a decision) and Informed (told after). In an incident it stops two problems: decisions nobody feels able to make, and decisions two people both think are theirs.
Why does every on-call role need a deputy?
Incidents do not wait for people to be available. The primary may be on leave, asleep, or locked out of a compromised account. A deputy with the same access and authority keeps the response moving. The roster records how long to wait before paging the deputy.
Which external contacts should we keep?
At minimum: your incident response retainer or forensics firm, external legal counsel, your cyber insurer or broker (and any panel-firm requirement), a crisis communications firm if you use one, the regulators that may need notification, law enforcement reporting routes, and your bank's fraud team for payment fraud. Check with counsel which regulators apply to you.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.