Define incidents and decision-makers
List the events that need a coordinated response: a compromised website account, a suspicious payment, a defaced page, a missing domain, unexpected data exposure or a website outage. Name a primary coordinator and backup. Make clear who can disable access, contact vendors, notify leadership and approve customer communications.
A small organization may rely on an external IT or hosting provider. Record the provider’s official emergency contact and account verification process. Do not store a secret password in the response document; store a pointer to the approved password manager and keep the document available to authorized staff.
Write the first steps for common scenarios
For suspected account compromise, use a trusted device to secure the account, revoke active sessions, inspect recovery details and preserve evidence. For payment redirection, contact the financial institution through a verified number immediately. For a website outage, check provider status and domain configuration before making repeated DNS changes.
Each scenario should explain how to contain further harm, what evidence to preserve and who must be contacted. Avoid promising that one action will solve every incident. If customer information may be involved, seek qualified privacy and legal advice about obligations that may apply.
Keep a reliable incident record
Use a shared, access-controlled log with dates, times, actions, people contacted, reference numbers and confirmed observations. Keep original messages and relevant screenshots. Label assumptions as assumptions and update the record when new information becomes available.
Decide where backups, hosting information, domain ownership records and vendor contracts are stored. Make sure an authorized person can access them if the primary administrator’s account is unavailable. Keep sensitive customer data out of general chat channels and public updates.
Test the plan and improve it afterwards
Run a short tabletop exercise: for example, a staff member receives a suspicious invoice and a social account posts an unfamiliar promotion. Ask people to locate the contact list, verify the request and record the next action. Note confusing steps and missing permissions.
After a real incident or exercise, assign improvement work with an owner and date. Update stale contacts, strengthen approval procedures and verify backups. The Canadian Centre for Cyber Security’s small-business guidance can help identify baseline controls; tailor the plan to the actual systems and risk of the organization.
Practical checklist
- Name a coordinator, backup and approved external contacts.
- Document scenario-specific containment and evidence steps.
- Keep recovery records accessible without exposing credentials.
- Practice the plan and close gaps with assigned owners.
In short
An incident plan should be short enough to use under pressure and specific enough that staff know who to contact and what to preserve.
This article is general educational information, not legal, privacy, cybersecurity or financial advice. Confirm requirements for your situation with a qualified professional.