Build a Basic Incident Response Plan
You do not need a 50-page manual. You need one page that says who leads, who to call, and what to do in the first hour. Write it before you need it.
Before you start
- ✓A list of who does what during a crisis
- ✓Contact information for your IT provider, insurer, and key vendors
Steps
- 1
Name one incident lead and one backup. They own decisions during an incident, including whether to disconnect systems.
- 2
Write down the first-hour actions: isolate affected devices, preserve evidence, and do not power off or wipe anything.
- 3
Collect contact information for your IT provider, cyber insurer, legal counsel, and law enforcement (FBI IC3).
- 4
Define how you will communicate internally if email is down, such as a phone tree or a personal-cell group chat.
- 5
List your critical systems and their recovery priorities, so you know what to bring back first.
- 6
Decide in advance who is authorized to pay a ransom or engage a breach coach, and under what circumstances.
- 7
Run a 30-minute tabletop once a year: walk through a ransomware scenario and note what breaks in the plan.
- 8
Store the plan somewhere accessible when systems are down, such as a printed copy and a personal cloud account.