Incident response plan
An incident response plan your people can use
The plan names the incident types you are willing to prepare for, the person who is called first, the person who may decide, and the place the timeline is written while the work is happening. It is not a policy that restates a regulation. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
What the plan is
An incident response plan is a short record the company can use when something is already wrong. It is not a catalog of every tool you own.
Most plans we are shown fail in one of three ways. They name a role and not a person. They name a person who left. Or they were never compared with the path a real incident would take through identity, the application, and the vendor who still has a login. The rewrite starts there. We keep what is already true and replace the lines that are not.
The plan also says what will not be done in the first hour. People under pressure invent extra steps. A written stop-list, agreed on a quiet day, is part of the plan. So is the point at which you call a response firm, counsel, or an insurer. We do not become that firm.
Who it is for
This is for a company that has a document nobody has used, or no document at all, and does not want the first hour to be an argument about who decides. It is also for a company whose last incident was handled in a chat thread, and the only record is that thread.
It is not for a company that wants a logo on a template this week and a binder for a shelf. If the people who would be called will not sit with us, we will not pretend the plan is done. We'll need access to the right areas and people.
If the real need is SOC 2 readiness, an infrastructure assessment, or ISO 27001 readiness, say so. Those are other pages on this site, not a stretch of this one.
What we write
We write the call order for the incidents you name. A lost laptop, a vendor account, a payment system, and a customer-data export are different first hours. One generic page that covers all of them usually covers none of them. Each type gets the owner, the revoke step, and the record.
We write where the timeline lives while the incident is open. A timeline reconstructed the next week is a different document. The plan says which system, which channel, or which file receives the notes, and who is allowed to add them.
We write the handoff to anyone outside the company: counsel, the insurer, a response firm, a customer contact. The plan does not script their advice. It names who inside your company is allowed to make the call, and what facts that person must have first.
You can decline the written scope before any of this starts. Once you approve it, we'll need access to the right areas and people. We need the current plan if it exists, a list of the systems that hold customer data or money, and time with the people named in the call order. Empty lines are filled with those people, not with guesses.
What this is not
This is not a 24-hour retainer, and this page does not quote a response time. If an incident is underway and you need someone else on the keyboard tonight, say that in the first note. We will tell you if this engagement is not the fit.
This is not legal advice, and it is not a promise about fines, insurance payment, or customer reaction. Those outcomes depend on facts we do not invent and on decisions that stay with you.
The plan stays with you when we leave. The engagement is finished when the people you already have can run the next incident from the record, not when a file has been emailed into a folder nobody opens.
We work around your normal operations, and we'll need access to the right areas and the right people while we do.
Questions
What does an incident response plan consultant deliver?
A written plan your people can use: who is called, who decides, which systems matter first, and how the record is kept. The plan stays with you. We need access to the right areas and the right people to write it against the operation you actually run. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
Do we have to throw away the plan we already have?
No. We start from the document you have, if you have one. If it names people who have left, or it was never used on a real afternoon, we mark those lines and rewrite them with the people who would be called now.
Contact
Task us with the plan you have, or the lack of one.
A rough note is enough to start. We work around your normal operations, and we'll need access to the right areas and the right people while we do.