BlogSecurity
Incident response plan basics
By David Otieno, Senior ICT Consultant 1 min read
Roles, contacts, first steps and communication — a short plan written in advance shortens every incident.
Security incidents are stressful. A plan prepared in calm conditions guides people when it matters.
Who does what
Name the incident lead, technical responders, management contact and communications person.
Contacts
Keep phone numbers for staff, IT providers, insurers and relevant authorities — on paper as well as digitally.
First steps
Contain the problem, preserve evidence and assess the impact.
Communication
Decide how and when to inform staff, customers and partners, and consider legal obligations, including notification requirements under the Data Protection Act, 2019 where personal data is affected.
Learn
After every incident, review what happened and improve.
Practise
Run a short tabletop exercise once or twice a year: walk through a realistic scenario such as ransomware or a lost laptop with sensitive data, and check that people know their roles and can find the contacts and procedures.
See our security services.
About the author
David Otieno
Senior ICT Consultant
David Otieno writes about cybersecurity, physical security systems, power resilience and running IT reliably day to day.