Skip to content

Plan

Incident Response Plan

What to do when something goes wrong. Print and pin it to the wall.

This plan exists so that when an incident happens, people don't freeze, panic, or destroy evidence. It works whether the network is up or down — print copies and leave them somewhere not reliant on IT.

How to use this: The bracketed items like [Company Name] are placeholders — replace them with your own details. Edit the wording to suit your business. This is a starter, not legal advice.

If you suspect a cyber incident

  1. Contain. Disconnect the device from the network (unplug Ethernet, turn off Wi-Fi). Do not power it off — memory evidence matters.
  2. Don't tidy up. Don't delete files, don't reboot, don't “just have a quick look.”
  3. Call. See the contact list below.

Who to call, in order

  1. IT supplier (out-of-hours): [name, phone]
  2. Cyber insurer claims line: [number], policy [policy number]
  3. Incident response provider: [number from insurance panel]
  4. Senior decision-maker: [name, mobile]
  5. Bank fraud line (if money may have moved): [number]

Within the first 4 hours

  • Document what you see: time, screens (photographs are fine), who noticed it, what was running.
  • Identify scope: which devices, which users, what data.
  • Start the ICO 72-hour clock if personal data may have been accessed or lost: 0303 123 1113.
  • Report to Action Fraud for fraud or attempted fraud: 0300 123 2040.
  • For phishing emails: forward to report@phishing.gov.uk.

What not to do

  • Don't pay any ransom without legal advice. It may be illegal under sanctions.
  • Don't restore from backup onto a still-infected network.
  • Don't email anyone outside the response team using the compromised email account.
  • Don't post about it publicly until comms are agreed.

Other key contacts

  • Lawyer: [name, number]
  • HR lead: [name, number]
  • PR / comms: [name, number]

Roles

  • Incident commander: [name] (decides scope of response, calls in suppliers)
  • Technical lead: [name] (works with IT supplier / IR provider)
  • Comms lead: [name] (handles internal, customer, and supplier messages)
  • Note-taker: [name] (keeps a timestamped log of decisions — matters for insurance and the post-mortem)

After the incident

Within two weeks of recovery, run a written post-mortem covering: timeline, what worked, what didn't, lessons, actions, owners. Update this plan based on the lessons.

Review

Reviewed annually, or after any significant incident.

Tips for adoption

  • Print and laminate. Put one copy in reception, one in the car, one at home.
  • Run a 90-minute tabletop exercise once a year using NCSC Exercise in a Box.
  • Test the phone numbers annually. They move.