IR Plan Merger
Two companies, two incident response plans. Put them side by side, row by row: severity model, on-call, IR retainer, insurer, counsel, notification owner, evidence tooling, backups, comms lead, testing and playbooks per incident domain. You get the gaps, the conflicts, a Day-1 interim decision for each row and a merged RACI you can copy into the integration plan.
Plan attributes
Day-1 interim: Fabrikam Holdings's model (4 levels (Sev 1–4)) is the single interim model. Publish a mapping of Tailspin Logistics's levels to it so nobody escalates on the wrong scale.
Day-1 interim: Route Tailspin Logistics's critical alerts and incident reporting into Fabrikam Holdings's 24x7 internal soc from Day 1; local responders stay second line.
Day-1 interim: Ask Contoso Forensics (48h on site) in writing to add Tailspin Logistics's legal entities to Fabrikam Holdings's retainer before Day 1.
Day-1 interim: Until policies are consolidated, give notice to both insurers for any incident at either company and follow each policy's panel rules. Check Tailspin Logistics's change-of-control clause and run-off cover.
Day-1 interim: Same counsel for both. Keep it and confirm it covers every legal entity.
Day-1 interim: Fabrikam Holdings's Group DPO makes the notification decision for both, with counsel; Tailspin Logistics's Head of IT is consulted and supplies local regulator and contract obligations.
Day-1 interim: Keep both platforms; give Fabrikam Holdings's IR team read access to Tailspin Logistics's consoles from Day 1, raise Tailspin Logistics's retention to at least 12 months and forward identity, VPN and EDR logs into Fabrikam Holdings's platform as the first integration step.
Day-1 interim: Recovery capability differs. Treat the weaker estate as at risk: bring it to "Immutable and offline, restore tested" (Fabrikam Holdings's standard) within 90 days and take an offline copy of its critical systems before any network connection.
Day-1 interim: One voice: Fabrikam Holdings's Group communications director is spokesperson for incidents at either company; Tailspin Logistics's Marketing manager supports with local customer and staff messages.
Day-1 interim: Tailspin Logistics's plan is untested. Include its team in a joint tabletop in the first 30 days.
Playbooks by incident domain
Tick where each company has a written playbook.
| Domain | Fabrikam Holdings | Tailspin Logistics | Day-1 interim |
|---|---|---|---|
| Identity | Tailspin Logistics uses Fabrikam Holdings's playbook from Day 1, with Tailspin Logistics's system owners added. | ||
| Email / BEC | Both have one. Fabrikam Holdings's playbook applies to both; merge in Tailspin Logistics's local contacts and system specifics. | ||
| Data breach | Tailspin Logistics uses Fabrikam Holdings's playbook from Day 1, with Tailspin Logistics's system owners added. | ||
| Ransomware | Both have one. Fabrikam Holdings's playbook applies to both; merge in Tailspin Logistics's local contacts and system specifics. | ||
| Network | Tailspin Logistics uses Fabrikam Holdings's playbook from Day 1, with Tailspin Logistics's system owners added. | ||
| DevSecOps | Neither has one. Use the master plan for now and write this playbook in the first 100 days. | ||
| Cloud | Tailspin Logistics uses Fabrikam Holdings's playbook from Day 1, with Tailspin Logistics's system owners added. | ||
| OT / ICS | Fabrikam Holdings uses Tailspin Logistics's playbook from Day 1, with Fabrikam Holdings's system owners added. | ||
| Third party | Neither has one. Use the master plan for now and write this playbook in the first 100 days. | ||
| AI system | Neither has one. Use the master plan for now and write this playbook in the first 100 days. | ||
| Insider | Tailspin Logistics uses Fabrikam Holdings's playbook from Day 1, with Tailspin Logistics's system owners added. | ||
| M&A | Neither has one. Use the master plan for now and write this playbook in the first 100 days. |
Result
Merged RACI suggestion
| Activity | Incident commander (Fabrikam Holdings) | Security lead (Tailspin Logistics) | Notification owner (Group DPO) | Counsel (Wingtip Legal LLP) | Comms lead (Group communications director) | Executive sponsor (group CISO) |
|---|---|---|---|---|---|---|
| Declare and classify severity (interim model) | A | R | I | I | I | I |
| Lead response, Sev 1–2 (either company) | A/R | R | C | C | I | I |
| Lead response, Sev 3–4 at Tailspin Logistics | A | R | I | I | I | - |
| Containment on Tailspin Logistics's estate | A | R | I | C | - | I |
| Evidence preservation and forensics | A | R | I | C | - | I |
| Regulator and individual notification | C | C | A/R | R | C | I |
| Insurer notice | R | C | C | C | - | A |
| External communications | C | C | C | C | A/R | I |
| Staff communications | C | R | I | C | A | I |
| Post-incident review and lessons | A/R | R | C | I | I | I |
R = responsible, A = accountable, C = consulted, I = informed. Only one A per activity. Adjust to your organisation, then retire the interim plan once both companies run on the merged plan.
What this tool does
- After a merger or acquisition, two incident response plans exist and they rarely agree: different severity scales, different retainers, different insurers, different people deciding on notification.
- Enter both companies' plan attributes side by side. Sample values for a fictional deal are filled in so you can see the output first.
- Each row is marked Aligned, Gap or Conflict, with a concrete Day-1 interim decision: whose model applies, which retainer to extend, which insurers to notify, who decides on notification.
- Tick which incident-domain playbooks each company has to see where neither is covered.
- The result includes a merged RACI for ten incident activities. Copy the whole thing as plain text into your integration plan.
Frequently asked questions
How do you merge two incident response plans after an acquisition?
Do not try to merge everything on Day 1. Pick one plan to lead (usually the acquirer's), map the other company's severity levels to it, extend the lead company's retainer, counsel and on-call to the acquired entities, and name one notification owner and one spokesperson. Keep the acquired company's local responders and playbooks for their systems. Then run a joint tabletop and write the merged plan over the first 100 days.
Which severity model should we use when two companies merge?
One model, from Day 1. Usually the lead company's, with a published mapping of the other company's levels, so a "P1" at one company and a "Sev 2" at the other trigger the same escalation. Two live scales are how escalations quietly fail.
What happens to cyber insurance and the IR retainer after an acquisition?
Neither transfers automatically. Retainers often name specific legal entities, and cyber policies differ on newly acquired entities and change of control. Until the position is confirmed in writing, give notice to both insurers for incidents at either company and keep the acquired company's retainer live.
Is my data uploaded?
No. Everything runs in your browser. Nothing you type is sent anywhere, and nothing is stored after you close the page.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.