TOOLBOX · DOWNLOAD
IT emergency manual as a template.
In an emergency, there is no time to clarify responsibilities and search for phone numbers. An IT emergency manual brings together in advance what will be needed then: roles, immediate measures, alerting and escalation, as well as communication and recovery plans, as described in the BSI module DER.4. This template provides an outline with sample texts and tables to fill in. It is based on BSI Standard 200-4, the NIST guides SP 800-34 and SP 800-61, and the requirements for contingency plans that have applied since October 2026 to entities under the NISG 2026 (Austrian Network and Information Systems Security Act 2026).
Free PDF · Template
IT Emergency Manual: Template for Alerting, Immediate Measures and Recovery
- Topic
- Backup & Emergency
- Format
- PDF, A4
- Length
- 12 pages
- Size
- 142 KB
- Updated
- Oct 25, 2026
- Sources
- 11
- Usage
- Adaptation for your own use permitted; redistribute unchanged
WHO IT IS FOR
Who This
Is for.
Fillable outline with crisis team, contact list, classification, immediate measures, recovery and exercise plan, backed by BSI Standard 200-4, NIST and the NISG 2026.
- Management of small and medium-sized companies that want to prepare for IT emergencies
- IT managers, information security officers and business continuity officers
- IT service providers who create and practice contingency plans with their customers
- Essential and important entities that must document their contingency plan under the NISG 2026
9 SECTIONS
What Is
Inside.
- 01
What belongs in the IT emergency manual
Content according to BSI DER.4, structure according to BSI Standard 200-4, and what is mandatory under the NISG 2026.
- 02
Scope and crisis team
What the manual applies to, who sits on the team, who deputizes and what the team may decide without consultation.
- 03
Alerting and contact list
From the first indication to an alerted team, with internal and external contact lists to fill in.
- 04
Disruption, emergency or crisis
The three levels according to BSI Standard 200-4, guiding questions for the initial assessment and the link to the NIS2 reporting obligation.
- 05
Immediate measures in the first minutes
Life and health first, then contain the damage and secure evidence: checklists for all employees and for IT.
- 06
Recovery: order and target values
Define MTPD, RTO and RPO per system, plan the order by dependencies and check backups before restoring.
- 07
Internal and external communication
Who learns what and when, through which channels, and which reporting obligations run in parallel.
- 08
Log and closure
What is recorded during the response, a log template and the steps back to normal operations.
- 09
Exercises and maintenance
Which exercises the BSI standard provides for, how often, and when the manual needs to be updated.
EXCERPT
Disruption, emergency or crisis
| Level | Characteristic | Response |
|---|---|---|
| Disruption | Processes or resources are not available as intended; can escalate to an emergency if not resolved within a reasonable time | normal organization, such as incident management |
| Emergency | at least one time-critical business process is interrupted and cannot be restored in normal operations within the maximum tolerable period of disruption; may already be declared when the interruption is imminent | crisis team with existing or adaptable plans |
| Crisis | damaging event with significant negative impact for which no suitable contingency plans exist or for which they do not work | crisis team, situational |
In an event, this means two questions must be answered: Is a time-critical business process affected, and is there an applicable plan? Guiding questions for the IT reporting point based on a BSI example (ch. 5.2.1, Table 10), to be adapted to your processes and worded so that they can be used without in-depth expertise. Sample text: “As soon as any question is answered with yes, notify the team lead immediately: [Name], phone [Number].”
- Is the affected system part of the security infrastructure, such as antivirus or firewall?
- Does the outage affect many users or core business operations?
- Is there a strong suspicion of manipulation of data or systems, data exfiltration, unauthorized exercise of rights or a targeted attack?
- Is the impact likely to last longer than [8] hours?
- Are customers, the media or supervisory authorities affected?
Link to NIS2: For entities in sectors outside Implementing Regulation (EU) 2024/2690, a cybersecurity incident under § 5 para. 1 no. 9 NISV 2026 is always considered significant if it has activated crisis management or disaster recovery plans (explanatory notes on § 5). If such an entity declares an emergency because of a cyberattack, the report under § 34 NISG 2026 must be assessed immediately. For managed service providers, cloud and data center services and the other providers covered by the Implementing Regulation, Art. 3 et seq. of the Implementing Regulation apply instead; this criterion is absent there, but the threshold of €500,000 or 5% of annual turnover is the same (Art. 3(1)(a)).
SOURCES
Supported
by Sources.
- BSI Standard 200-4 Business Continuity Management, version 1.0 (2023) (opens in a new tab)Ch. 2.1, 2.3, 2.6.1, 4.4, 5.1 to 5.9, 7, 12.2, 12.3 and 13
- BSI IT-Grundschutz-Kompendium, module DER.4 Business Continuity Management, Edition 2023 (opens in a new tab)Requirement DER.4.A1 creating an emergency manual
- BSI: IT emergency card “Behavior in IT emergencies” (opens in a new tab)
- BSI and partners: TOP 12 measures for cyberattacks, as of September 2019 (opens in a new tab)
- NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems (opens in a new tab)Sections 3.2.1, 3.5.2, 3.6, 4.2.2, template in Appendix A.1
- NIST SP 800-61r3: Incident Response Recommendations (April 2025) (opens in a new tab)RC.RP-03, RC.RP-05, RC.RP-06
- NISG 2026, BGBl. I No. 94/2025, current version in the RIS (opens in a new tab)§ 32 para. 4 lit. c, § 34 para. 2, version of October 25, 2026
- NISV 2026, BGBl. II No. 290/2026 (opens in a new tab)§ 2 and § 5 para. 1, promulgated on October 1, 2026
- Implementing Regulation (EU) 2024/2690, Annex (opens in a new tab)Points 3.5.4, 4.1.2 and 4.1.4
- Regulation (EU) 2016/679 (GDPR), Art. 33 and 34 (opens in a new tab)Proposal COM(2025) 837, procedure 2025/0360(COD) pending, as of October 25, 2026
- Federal Office for Cybersecurity: explanatory notes on the NISV 2026 (PDF) (opens in a new tab)On § 5: applies to sectors outside Implementing Regulation (EU) 2024/2690
Adapt this template to your company: roles, systems, target values and exercise intervals depend on your business processes. It provides an overview and does not replace legal advice; the text of the law in its current version is decisive.
TOOLBOX
Explore
Further.
- Kostenlos
NIS2 applicability check (German)
Am I affected? In 3 minutes
Check Now NIS2 reporting obligations
Guide with deadlines, content and recipients of reports under the NISG 2026, including a checklist.
Learn MoreBackup checklist 3-2-1-1-0
Data backup checklist with offline copy and tested restore.
Learn MoreRPO and RTO
How much data loss is acceptable and how quickly systems must be back, explained in the glossary.
Learn More
BACKUP & EMERGENCY
More on
This Topic.
- PDF
Backup Checklist 3-2-1-1-0
Three copies, two media, one off-site, one offline, zero errors in the recovery test: a data backup checklist, backed by BSI and CISA.
View - PDF
Ransomware: First Aid
Isolate without destroying traces, secure evidence, block access, report correctly: what matters in the first hours and what you should avoid, backed by BSI, CISA, and the Austrian Federal Criminal Police Office.
View - PDF
Incident Response Playbook
Who does what when a security incident occurs? Phases, roles, decisions with criteria and a fill-in incident log, based on NIST SP 800-61r3, BSI DER.2.1 and the NISG 2026.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.