The Incident Response Plan

The worst time to write a plan is at 7:40 on a Monday morning, with a ransom note on every screen.

When something goes wrong (ransomware, a hacked email account, a fake invoice paid, a lost laptop), the first hour decides how bad it gets. Who decides? Who calls the insurer? Do you switch everything off? What do you tell staff, and customers? Companies with a plan answer those questions in minutes. Companies without one make them up as they go.

This kit gives you the plan, ready to fill in, and the guide to make it work.

What's in it

• The plan, as an editable Word file: ten short sections. They cover what counts as an incident, how to report it, three severity levels, who does what, the first hour step by step, the first day, who you may have to tell, the decisions the incident lead can make alone, recovery and review, and keeping it ready. Every gap you need to fill is highlighted.
• Three appendices: a contact sheet to print and keep offline, message templates for staff, customers and suppliers, and an incident log.
• The guide (PDF): the six things to sort out first (including what your cyber insurer requires), a first-hour card to keep by the phone, what to say and who you may have to tell, and three 30-minute practice scenarios with an after-incident review.

Who it's for

Owners, CEOs and leadership teams at small and growing companies, and the IT managers or providers who'd be first on the phone, especially if the honest answer to "if we were hit tonight, who calls whom?" is "I'm not sure".

It builds on The Security Questions Every Executive Should Be Able to Answer, and pairs with Security Basics for Executives, whose 45-minute ransomware rehearsal makes a good first practice.

For everything that isn't a cyber attack, The Business Continuity Plan keeps the business going when the building, the systems, the people or a key supplier don't.

It's a practical template, not legal advice. Notification rules vary by state and country, so check yours with a lawyer.

You get two files: the plan in Word format (it also opens in Google Docs and Pages) and the 4-page PDF guide.