In a crisis, nobody thinks clearly. A written incident response plan means people know what to do before the pressure starts.

What the plan should cover

1. Purpose and scope. What counts as an incident (malware, phishing compromise, lost device, data leak, outage) and which systems the plan covers.

2. Roles and responsibilities.

– Incident lead: coordinates the response

– Technical lead: investigates and contains

– Communications lead: handles staff, customers, and media

– Executive sponsor: makes business decisions

– Legal and privacy contact: advises on obligations

– Name a backup for each role.

3. Contact list. Keep it somewhere you can reach offline: your IT provider, cyber insurer’s hotline, legal counsel, key vendors, and law enforcement contacts.

4. Response phases.

1. Prepare: tools, training, backups, and this plan

2. Detect and analyze: confirm what happened and how serious it is

3. Contain: isolate affected systems and accounts

4. Eradicate: remove the cause and close the entry point

5. Recover: restore from clean backups and verify systems

6. Review: document lessons and improve

5. Severity levels. Define low, medium, and high incidents with different response expectations.

6. Communication rules. Who may speak externally, what is said, and where internal updates are posted if email is down.

7. Legal and regulatory duties. Under Quebec’s Law 25, incidents posing a risk of serious injury must be reported to the Commission d’accès à l’information and affected people, and all incidents must be recorded in a register. Note other contractual notification duties.

8. Evidence handling. Keep logs and records, and avoid altering affected systems unnecessarily.

Make it real

– Print a short one-page version

– Run a tabletop exercise once a year

– Update contacts every quarter

– Review after every real incident

DBR Soft can help you build and rehearse your incident response plan. Contact us for more information.