An incident plan is useful when it helps people decide what to do next. It does not need to start as a large document. A concise set of contacts, responsibilities and recovery priorities is a better foundation than a detailed plan that nobody can find or operate.
Preparation reduces uncertainty. A rehearsal is valuable because it exposes decisions you have not yet agreed.
Name the people who make decisions
Identify a business lead, a technical lead and the people responsible for communications. Include your provider, important application suppliers and other advisers where appropriate. Record contact methods that do not depend entirely on the system being affected. Establish who can approve urgent technical work and who can decide to pause a business process. Make deputies part of the arrangement.
Technical background: NCSC: Small Business Guide to Response and Recovery ↗
Agree the first escalation route
Describe how staff report something unusual and how the initial report reaches authorised responders. People should know what information to provide and when to avoid further interaction with a suspicious message or affected system. Technical containment needs to be directed by qualified responders. Avoid writing blanket instructions to wipe or rebuild devices, because those actions can remove information needed to understand the event.
Prioritise business activity and communication
List the services that matter most and identify acceptable temporary working arrangements. Decide how staff, customers and suppliers will receive updates. Keep a record of decisions, timing and actions. Technical recovery, business communication and any reporting obligations need their own owners. Your incident plan should point to appropriate specialist advice where the situation raises contractual, legal or insurance questions.
Rehearse a small realistic scenario
Run a discussion exercise before you face a real event. For example, ask how the team would respond if email were unavailable and a key staff member could not be reached. Note missing contacts, unclear authority and unsupported assumptions. Set actions with owners, then test the updated plan again. The purpose is to improve coordination, not to declare that a successful discussion proves every system can recover.
PUT IT INTO PRACTICE
Your starting checklist.
Use these prompts to prepare your next decision or conversation.
YOUR NEXT STEP WITH IT MOUNTAIN
Turn the question into a plan.
Bring your critical services and current response arrangements to IT Mountain. Discuss how security escalation and recovery planning should connect.
