The National Cyber Incident Response Plan (NCIRP)

The National Cyber Incident Response Plan (NCIRP) describes a national approach to handling significant cyber incidents. It addresses the important role that the private sector, state and local governments, and multiple federal agencies play in responding to incidents. It also describes how the actions of all these stakeholders fit together to provide an integrated response. The NCIRP reflects and incorporates lessons learned from exercises, real world incidents, and policy and statutory updates including Presidential Policy Directive/PPD-41 – US Cyber Incident Coordination (and its annex) and the National Cybersecurity Protection Act of 2014.

What is the NCIRP Update?

CISA is leading an effort to update the National Cyber Incident Response Plan (NCIRP), as directed in the 2023 National Cybersecurity Strategy, “. . . to ensure that the breadth of our nation’s capacity is effectively coordinated and leveraged in reducing the impact of cyber incidents.” CISA is working hand in hand with our public and private sector partners including interagency partners, sector risk management agencies (SRMAs), and regulators to build upon the successes of the first inaugural plan and incorporate valuable lessons learned during the last seven years.

The NCIRP was first published in 2016 and serves as the nation’s framework for coordinated response to significant cyber incidents. Since that time, the cybersecurity threat landscape and national response ecosystem have changed dramatically, resulting in a growing need to update this foundational document. Through the NCIRP 2024 planning effort, CISA will address many of these changes, while making the NCIRP more inclusive of non-federal stakeholders and establishing a foundation for continued evolution of the nation’s capability to collectively respond to and manage significant cyber incidents.