Cybersecurity Glossary
Incident Response Plan
The written plan for what happens in the first hours after something goes wrong.
What Incident Response Plan means
An incident response plan covers detection, containment, eradication, recovery and the lessons afterwards. The most valuable part is the first page: who decides, who is called, in what order, and using which communication channel if email is unavailable. Contact details belong on paper as well as online.
Why Incident Response Plan matters for small businesses and nonprofits
During an incident nobody is thinking clearly. Notification deadlines under data protection law are short, and insurers usually require early notification. Having the plan is often the difference between a controlled response and an expensive improvisation.
What to do about Incident Response Plan
- Write down the first hour: who decides, who is called and on which numbers
- Store a copy offline, because it may be on an encrypted server otherwise
- Test it once with a tabletop exercise before you need it
Not sure where you stand on this?
We review your current setup against the basics, tell you plainly what is covered and what is not, and give you a ranked list with effort and cost. No jargon and no scare tactics.