Day-1 Incident Response Integration Plan
Who leads an incident at the company you just bought, on the day you buy it? Twenty-five items across command, merged on-call, IR retainer and insurer notice, an interim severity model, notification ownership, log access and TSA terms, with a Day-1 readiness verdict.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
What must be agreed before close so that an incident at the acquired company on Day 1 has a leader, an on-call path, an IR retainer and insurer notice route, one severity model, a notification owner and access to the logs. Mark each item Not started, In progress, Agreed or Tested. Any material item that is not at least in progress makes the plan "Not ready".
- The acquirer's IR retainer covers the acquired company from close (or the target's retainer is kept until it does)
Your context
Who leads an incident on Day 1
On Day 1 two incident processes exist and neither knows the other. Decide in advance who is in charge, or the first incident will be spent arguing about it.
A named incident commander (and deputy) is agreed for incidents at the acquired company from the minute of closematerial
The escalation path from the acquired company to the acquirer's CISO, general counsel and executive crisis team is documented with phone numbersmaterial
Decision rights are agreed: who can isolate a site, disable accounts, take systems offline or engage outside firms at the acquired company
Where the seller keeps any role (TSA services, shared infrastructure), the seller's incident contact and cooperation duties are named
Merged on-call and detection
A single 24x7 on-call number or rota covers the acquired company from Day 1, even if the teams stay separatematerial
Acquirer EDR or an agreed equivalent is deployed to the acquired estate, starting with servers, domain controllers and remote-access hostsmaterial
Staff at the acquired company know how to report a suspected incident from Day 1, and the old route still works
Existing MSP or MSSP contracts at the acquired company are reviewed for alerting, hand-off and access to their tooling
IR retainer, insurer and counsel
The acquirer's IR retainer covers the acquired company from close (or the target's retainer is kept until it does)material
Cyber insurance: the acquired entities are added to the acquirer's policy (or the target's policy and run-off cover are confirmed), and the insurer notice requirements are knownmaterial
External breach counsel is engaged for the acquired company so investigations can run under privilege where available
Forensic firm, ransomware negotiator and crisis comms agency contacts are listed for the acquired company
Interim severity model
One interim severity model applies to both companies from Day 1, with a mapping from the acquired company's old levelsmaterial
Automatic escalation triggers are agreed: any suspected personal-data exposure, ransomware, payment fraud or loss of a critical system goes to the acquirer's IR lead
For a listed acquirer, the route to the disclosure committee for a materiality decision is defined for incidents at the acquired companySEC Form 8-K Item 1.05
Communications and notification ownership
A named owner decides on regulator and individual notifications for the acquired entities, with counsel, and knows which regulators and clocks applyGDPR Art. 33material
Holding statements for customers, staff and media are pre-approved for the combined company
One spokesperson and one approval route cover incidents at either company
Customer and supplier contract notice obligations of the acquired company are listed with their deadlines
Logging and evidence access
The acquirer's IR team has read access to the acquired company's key logs (identity, VPN, firewall, EDR, email, cloud) from Day 1, or a named person who can pull them within an hourmaterial
Log retention at the acquired company is extended to at least 12 months for security logs, and nothing is deleted during integration
A preservation instruction covers systems due for decommissioning, so evidence of any pre-close compromise is kept
TSA and carve-out implications
Skip this section when there is no transitional services agreement.
The TSA states who detects, responds to and notifies for incidents on services the seller still runs, with response times
The acquirer has the right to evidence, logs and forensic cooperation for TSA-provided systems
The plan to leave TSA services includes when incident response moves fully to the acquirer
Day-1 incident roles
Who does what for an incident at the acquired company in the first 100 days.
What this template gives you
- On Day 1 there are two incident processes and neither knows the other. This plan decides, before close, who is in charge.
- Material items cover the incident commander, escalation path, 24x7 on-call, EDR visibility, IR retainer and insurer coverage of the new entities, one severity model, the notification owner and log access.
- Any material item with no owner makes the plan "Not ready"; items in progress make it "Ready with conditions".
- The roles table records the interim lead for each role, including services the seller still runs under a TSA.
Frequently asked questions
Who should lead an incident at an acquired company on Day 1?
Usually the acquired company's own security lead runs response on their estate, because they know it, with the acquirer's IR lead taking command for higher-severity incidents. What matters most is that it is agreed and written down before close, with phone numbers and pre-authorised containment actions.
Is an acquired company covered by our IR retainer and cyber insurance?
Not automatically. Retainers often name specific legal entities, and cyber policies differ on whether newly acquired entities are covered and above what size they must be declared. Ask the retainer provider and the broker in writing before close, and check run-off cover on the target's own policy.
Which notification clocks apply to an incident at the acquired company?
The ones that applied before close still apply: the acquired legal entity usually remains the controller of its data. GDPR gives 72 hours from becoming aware to notify the supervisory authority. A US-listed acquirer must also assess materiality, with SEC Form 8-K Item 1.05 disclosure due within 4 business days of a materiality determination. Confirm the position with counsel.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.