sysop@hub:~/tools/incident-plan-builder$

incident-plan-builder

On the day ransomware hits, nobody reads a forty-page policy, and the file server with the phone list on it is the thing that is down. This makes the one page that hangs on the wall: what whoever notices does first, and who is called. Fill in the fields, print it, and keep a copy at home. Nothing you type is stored or sent anywhere.

We handle personal data of people in the EU or UK (adds the 72-hour reporting step)

the page

A starting point for a company without a security team, not legal advice. Reporting duties depend on your country and industry: ask your data protection contact and your insurer what applies to you, before you need it. Once a year, call two of the numbers to see whether they still work. Related: incident runbook for the technical side, incident simulator to practise, backup and disaster recovery checklist, compromised account checklist.