# How To Prepare and Apply an Incident Response Plan With BetterShield?

Build a response plan from incident evidence, review each proposed action, and apply only the actions you approve.

In **[BetterShield](/)**, an open incident can offer a response plan based on its recorded accounts, files, and related activity.

## What it does

The plan proposes supported responses and explains why each one fits the evidence. Preparing a plan does not apply it. Actions that can affect access, files, or configuration remain separate decisions and may require confirmation.

<span id="set-it-up" aria-hidden="true"></span>

## Step 1: Prepare and Apply an Incident Response Plan

Open the incident, read its evidence, then prepare the response plan. Review the target, effect, and reversal note for every proposed action before approving it.

<figure class="doc-shot">
  <img src="/docs/screenshots/incident-response-plan.png" alt="Suggested fixes panel with the Prepare Response Plan control." width="940" height="97" loading="lazy" decoding="async">
  <figcaption>Prepare a response plan from one incident before reviewing any proposed action. This view uses example incident data.</figcaption>
</figure>

## Recommended settings

Keep a working recovery method and current backup before changing access or files. Apply the smallest useful action first and verify its result before continuing.

## What it can break and how to undo

Suspending an account can block its owner. Restoring a file can remove an intentional modification. Other proposed actions have their own limits. Use the reversal offered for that completed action when available, or restore from your verified backup. Do not assume every external change can be undone by BetterShield.

<span id="check-it-is-working" aria-hidden="true"></span>

## Final Outcome

Each approved action should show its outcome and create an activity record. Re-check the account, file, or setting directly.

<figure class="doc-shot">
  <img src="/docs/screenshots/incident-response-plan.png" alt="Suggested fixes panel with the Prepare Response Plan control." width="940" height="97" loading="lazy" decoding="async">
  <figcaption>Example Incident response plan view. Check the saved values and status on your own site.</figcaption>
</figure>

## Related

- [Read an incident's evidence and related activity](/docs/incident-evidence/)
- [Set up recovery](/docs/set-up-recovery/)
- [Review files kept in quarantine](/docs/file-quarantine/)

This is how you can prepare and apply an incident response plan with BetterShield.

Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).