HowyGuardHow do I write an incident response plan?
Write one page called If we get hacked. List who to call first, including your insurer's incident line from your policy, how to stop the damage, where your backups are and who can restore them. Print it, keep a copy away from the computers, read it through with your staff once a year, and date it.
An incident response plan is a written page that says what your business does if it's hacked.
Check if you already have it
You have one if there's a dated, printed page that says who to call, how to stop the damage and where the backups are, and you've read it through with your staff in the last year.
How to set it up
Write a one-page plan for a bad day
Any setup, needs your insurance policy, your IT contacts, and your bank's phone number
- Open a blank document called If we get hacked.
- Write who to call first: your insurer's incident line (it's in your policy), your IT help or tech, and your bank.
- Write how to stop the damage: unplug the affected computer from the network, don't turn it off, and change the email password from a different device.
- Write where your backups are and who can restore them.
- Write who you may need to tell, such as clients, and who decides that. Your insurer's incident line can help with this part.
- Print it and keep a copy away from the computers. Paper still works when the computers don't.
- Once a year, read it through with everyone at the business and update phone numbers.
How to show it's true: Keep the dated plan and a note of each yearly walk-through.
- You don't know your insurer's incident line: call your broker and ask. It's worth having before you need it.
If you don't know where your backups are, sort that out first with how to set up an offline backup.
How to show it's done
Keep the dated plan and a note each time you walk through it with staff. File both in your proof folder.
Common questions
My form asks about a business continuity plan. Is this the same?
They overlap. A business continuity plan covers any outage, not just an attack. Add a line on how you'd keep seeing clients if the computers were down, and the same page covers both.
My form asks how often we test the plan. What do I answer?
Your yearly walk-through is a test. Write the date down each time. If it also asks how fast you can recover, only answer from a real restore test.
Where do I find my insurer's incident line?
In your policy documents. If you can't find it, ask your broker and add it to the plan.