Pricing
Simple Pricing. Built for Nonprofit Budgets.
Start with a one-time plan. Upgrade when you're ready to test it, keep it current, and present findings to your board.
FREE
$0 — No account required
The starting point. Download a sample incident response plan and supporting templates to understand what a complete IRP looks like — before you build your own.
What's included:
- Sample Master Incident Response Plan (watermarked)
- Sample Incident Report Form
- Sample Emergency Contact One-Pager
- Downloadable IRP templates
What's not included:
- Branded PDF output with your organization's name, logo, and colors
- Intake form — the questions that make your plan specific to your organization
- State-specific regulatory language
- Any of the IRPForge-generated content
STARTER
$199 one-time
Available now
Your complete, branded, audit-ready incident response plan. One payment. No subscription. Yours to keep.
What's included:
- Full intake form wizard — 24 questions across 6 phases, takes 10–20 minutes
- Master Incident Response Plan — 14 sections, state-specific regulatory language, named contacts and escalation paths, your organization's branding
- Incident Report Form — structured reporting document for use during a live incident
- Emergency Contact One-Pager — all critical contacts on a single page, designed for active incidents
- PDF output — immediately downloadable, audit-ready, presentable to your board or insurer
- One generation — your plan reflects your answers at the time of generation
Output format: PDF
Want to update your plan? Regenerate anytime for $199. Or upgrade to Professional when it launches for unlimited annual updates in an editable Word document.
Early adopter offer: Starter customers receive 50% off their first year of Professional when it launches.
PROFESSIONAL
$399/year
Coming Soon
Everything in Starter, plus the ability to edit your plan, keep it current every year, and test it with your team — without hiring a consultant.
What's included:
- Everything in Starter
- Word document output — fully editable, redline-ready, legal team friendly. Make it yours without stripping anything out.
- Annual regeneration — one new plan per year, updated as your team, technology, and regulatory environment change
- Tabletop Exercise Generator — scenario-based exercises your team runs internally. Scenarios include: ransomware, business email compromise, vendor breach, Microsoft 365 compromise, and data exposure. Replaces $500–$5,000 consultant-facilitated tabletop engagements.
- Unlimited document updates within your subscription year
Output format: Word document (editable)
IRPs should be reviewed and updated at least once a year. Professional makes that automatic — and adds the testing layer that turns a document into a practiced capability.
Not available yet. Starter customers will receive 50% off their first year of Professional when it launches.
ORGANIZATION
$799/year
Coming Soon
The full incident response lifecycle. Create your plan, test it with your team, document what happened, and present findings to your board — all in one place.
What's included:
- Everything in Professional
- After Action Report Generator — structured findings, executive summary, and board-ready recommendations generated from your tabletop exercise notes and facilitator observations. Replaces significant consultant documentation effort after every exercise.
- Word document output throughout — every deliverable is editable
Output format: Word document (editable)
For organizations that run tabletop exercises regularly and need to demonstrate continuous improvement to their board, funders, or insurers — this is the full program.
Not available yet.
Compare Plans
| Free | Starter | Professional | Organization | |
|---|---|---|---|---|
| Price | $0 | $199 one-time | $399/year | $799/year |
| Status | Available | Available | Coming Soon | Coming Soon |
| Output format | Sample PDF | Branded PDF | Editable Word doc | Editable Word doc |
| Intake form | — | ✓ | ✓ | ✓ |
| Master IRP | Sample only | ✓ | ✓ | ✓ |
| Incident Report Form | Sample only | ✓ | ✓ | ✓ |
| Emergency Contact One-Pager | Sample only | ✓ | ✓ | ✓ |
| State-specific regulatory language | — | ✓ | ✓ | ✓ |
| Annual regeneration | — | — | ✓ | ✓ |
| Tabletop Exercise Generator | — | — | ✓ | ✓ |
| After Action Report Generator | — | — | — | ✓ |
| Early adopter discount | — | 50% off Professional yr 1 | — | — |
Common Questions
- What does "one generation" mean for Starter?
- One complete run through the intake form, producing your three documents. You can download and keep them permanently. If your organization changes significantly — new IT lead, new state, new insurance carrier — you can regenerate anytime for $199. Or wait for Professional to launch for unlimited annual updates.
- What's the difference between PDF and Word document output?
- PDF output is the Starter format — branded, professional, audit-ready, immediately shareable. You can't edit it directly in a PDF reader without third-party tools. Word document output, available in Professional and Organization, gives you a fully editable file. Your legal team can redline it. Your operations staff can update contacts directly. Your board can add notes. No stripping, no reformatting, no workarounds.
- When will Professional and Organization be available?
- We're building them now. Starter customers will be the first to know — and will receive 50% off their first year of Professional when it launches. Get started with Starter today and you'll be on the early adopter list automatically.
- Is there a free trial?
- The Free tier is your trial. Download a complete sample plan — watermarked and pre-filled with example data — to evaluate the format, depth, and structure before purchasing Starter.
- What happens to my data?
- Your intake responses are stored in our database. You can request deletion at any time. We do not sell your data. See our Privacy Policy.
IRPForge is a document generation tool. It produces a written incident response plan for planning purposes only. It does not monitor your systems, provide active incident response services, or guarantee protection against any security threat. Built on CIS Controls v8 and the NIST Cybersecurity Framework — not certified or endorsed by NIST or CIS.