Why a plan, if you already have an IT partner
In the first hours of an incident, things go wrong because people are searching, not because they lack knowledge. Someone does not know who to call. Someone else means well, starts restoring files and wipes evidence in the process. The managing director is driving and nobody knows whether they need approval to take every laptop off the network. Your IT partner can do a lot, but only if they are called quickly and someone in the company is allowed to make decisions.
An incident plan records those agreements before you need them. It helps with ransomware, but just as much with a compromised Microsoft 365 account, a stolen laptop, a fake payment request that has already been paid, or a server that will not start after a power cut.
What goes on the page
- Who you call, in which order. Your IT partner’s out-of-hours number, your insurer’s claims line if you have cyber insurance, and the bank if payments are involved. Many policies expect you to call the claims line before you start recovering yourself.
- Who decides. One person plus a deputy who may decide to switch systems off, bring in extra help or inform customers. Also note who takes over if both cannot be reached.
- What staff do straight away. Unplug the network cable and turn off wifi when a screen looks suspicious, do not shut the computer down unless the IT partner says so, do not delete or restore anything, and report it to one fixed contact. Keep it to four or five short lines.
- Where the keys are. Not the passwords themselves, but where they are kept: the password manager, the break-glass account details, who has access to your domain name and DNS, and where the backups are.
- How to reach each other without email. If Microsoft 365 is down or being watched by an attacker, you need another channel, such as a printed phone list or a group chat on personal phones that you agreed in advance.
- Reporting a data breach. Who assesses whether personal data has leaked and whether you have to report it to the data protection authority. Under the GDPR that generally has to happen within 72 hours of becoming aware of it, so who handles it must be decided in advance.
Keep it outside your own systems
A plan that only lives on the file server or in SharePoint is out of reach during ransomware or an account takeover. Print it, keep one copy at the decision-maker’s home and one with the deputy, and store a digital copy somewhere separate from your business environment. Update the phone numbers when someone leaves or you change supplier; that fits well in your joiner and leaver checklist.
Run through it once a year
A plan that has never been tested always contains mistakes. An outdated number, a deputy who left long ago, a backup nobody knows how to restore. Once a year, take an hour to talk through a scenario: what do we do if all our files are encrypted tomorrow? Combine it with a practice restore of your backups, so you also know how long recovery really takes. Customers asking about your security because of NIS2 often want to see such a plan too.
What Floor ICT does
Floor ICT drafts the incident plan with you. We fill in the technical steps for your environment: how a device is isolated, where the backups are and how long recovery takes, and which break-glass accounts exist. As your MSP we are the first number on the list, and we go through the plan with you every year together with a restore test. What you tell customers or staff, and whether you report a data breach, is your decision; we provide the facts you need for it.