U.S. Flag Official website of the Department of Homeland Security
TLP:WHITE

The National Cyber Incident Response Plan (NCIRP)

The NCIRP:

  • The NCIRP describes a national approach to dealing with cyber incidents; addresses the important role that the private sector, state and local governments, and multiple federal agencies play in responding to incidents and how the actions of all fit together for an integrated response;
  • Reflects and incorporates lessons learned from exercises, real world incidents and policy and statutory updates, such as the Presidential Policy Directive/PPD-41: U.S. Cyber Incident Coordination, and the National Cybersecurity Protection Act of 2014.

The NCIRP also serves as the Cyber Annex to the Federal Interagency Operational Plan (FIOP) that built upon the National Planning Frameworks and the National Preparedness System.

This plan applies to cyber incidents and more specifically significant cyber incidents that are likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the American people. 

DHS’s National Protection and Programs Directorate (NPPD) and Federal Emergency Management Agency (FEMA)’s National Integration Center led the development of this document, in coordination with the Department of Justice, the Secretary of Defense, and the Sector Specific Agencies and other interagency partners, representatives from the 16 critical infrastructure sectors and state and local governments.

Download the refreshed NCIRP here.

  • National Cyber Incident Response Plan (PDF | 1.16 MB)

Webinar Sessions

To continue to outreach efforts to promote the NCIRP and engage with stakeholders, DHS is planning four webinar sessions hosted on the Homeland Security Information Network (HSIN) at 3:00 p.m. (EST) on March 27-30, 2017Each session will cover the same information and will focus on updates to the Plan and how it can be leveraged within your communities.

NCIRP Stakeholder Webinar #1
Date: Monday March 27, 2017
Start Time: 3:00 pm ET
URL: https://share.dhs.gov/r3fctx11w2x/ 
Conference number: 1-800-320-4330
Passcode: 372094

NCIRP Stakeholder Webinar #2
Date: Tuesday March 28, 2017
Start Time:  3:00 pm ET
URL: https://share.dhs.gov/r8bvryj2nu9/
Conference number: 1-800-320-4330
Passcode: 372094

NCIRP Stakeholder Webinar #3
Date: Wednesday March 29, 2017
Start Time: 3:00 pm ET
URL: https://share.dhs.gov/r6cmtu0qngo/
Conference number: 1-800-320-4330
Passcode: 372094

NCIRP Stakeholder Webinar #4
Date: Thursday March 30, 2017
Start Time: 3:00pm ET
URL: https://share.dhs.gov/r22skziadr4/
Conference number: 1-800-320-4330
Passcode: 372094

Back to Top