When a cyberattack hits, confusion costs time — and time costs money. An incident response plan decides in advance who does what, so your team can act instead of debating. It doesn't need to be long. It needs to be clear, current and practised.
The roles you need
- Incident lead: coordinates the response, tracks actions and keeps everyone informed.
- Executive decision-maker: makes the big calls — shutting down systems, spending money, engaging with attackers — with a named backup.
- Technical lead: directs investigation, containment and recovery, internally or with an outside firm.
- Legal and privacy: advises on obligations, including whether the breach must be reported.
- Communications: manages messages to staff, customers, partners and, if needed, the media.
- External partners: your incident response firm, insurer and lawyer, with contact details stored offline.
Decisions to make in advance
- Who can authorize taking systems offline, even if it disrupts the business?
- At what point do we involve law enforcement?
- What's our position on paying a ransom, and who must be consulted?
- Which systems do we restore first?
Keep it usable in a crisis
If your plan lives only on the file server that just got encrypted, it won't help. Keep printed copies and an offline version. Include phone numbers — email may be down or compromised — and a simple checklist for the first hour.
Practise with a tabletop exercise
At least once a year, walk your team through a realistic scenario, such as ransomware on a Friday night. Tabletop exercises reveal gaps safely: missing contact numbers, unclear authority, backups nobody knows how to restore. Fix what you find, then update the plan.
After every incident, learn
Once things are back to normal, hold a short review: what happened, what worked, what didn't and what you'll change. Small improvements after each incident add up quickly.
Key takeaways
- Name the roles — and their backups — before you need them.
- Store the plan and contacts somewhere that survives an outage.
- Rehearse at least once a year. Our incident response team can help you build and test your plan.