Incident response plan

A written plan that explains how your organization will detect, contain, investigate, recover from and communicate about a cybersecurity incident.

An incident response plan sets out who does what when something goes wrong. It typically covers how incidents are reported, who makes decisions, how to contain the damage, who to call (such as your IT provider, insurer, lawyer and bank), how to preserve evidence, how to restore systems and how to communicate with staff, clients and regulators.

During a ransomware attack or email compromise, there is pressure, confusion and little time. Businesses with a plan tend to contain incidents faster and make fewer costly mistakes, such as wiping evidence an insurer needs or delaying a required privacy breach notification to the Office of the Information and Privacy Commissioner of Alberta. Many cyber insurance policies also expect you to contact them quickly and use approved responders.

Practical tip: keep the plan short and practical, with an up-to-date contact list including your insurer's incident hotline. Store a printed or offline copy, since your email and files may be unavailable. Walk through a realistic scenario with key staff at least once a year.