A simple incident response plan helps reduce confusion during a suspected cyber incident. It should fit the organisation and be accessible to the people who may need it.
What an incident plan should cover
- Roles and contacts: identify who coordinates response, who contacts providers and who approves external communication.
- Escalation triggers: define when staff should report suspicious activity and when specialist help is needed.
- Account containment: know how to disable compromised accounts, revoke sessions and protect privileged access.
- Evidence preservation: record relevant times and observations; avoid unnecessary changes that may destroy useful evidence.
- Recovery priorities: list critical services, backup locations and restoration dependencies.
- Communication: prepare a process for staff, customers, suppliers and relevant authorities where applicable.
Practise before an incident
Walk through a realistic scenario with key staff, check that contact details work and verify that backups can be restored. Update the plan after major system or personnel changes.
When specialist support is needed
If you suspect an active compromise, contact your hosting provider or an appropriate incident response professional promptly. This planning guidance is not emergency response coverage or legal advice.
Discuss readiness
Use the contact page to discuss your organisation's requirements and the scope of any planning support.