Clear Path step · Business · A plan before you need it

Write a one-page incident plan and walk through it

OngoingAbout 90 minNowWith your team

If something goes wrong, everyone knows who leads, who to call and how to reach each other without email.

Why it matters: The first hour decides how much money comes back and how much data leaves. Deciding roles in advance stops panic and stops a second scam that pretends to be help.

Best after: Name an owner and map what you'd lose

Do it

  1. Name an incident lead and a backup.
  2. List phone numbers for the bank's fraud line, IT provider, insurer and lawyer on paper, outside your computers.
  3. Agree an out-of-band channel for staff if email or chat is compromised.
  4. Walk through one scenario, such as a deepfake payment request or a pasted client file.
  5. Report fraud at ic3.gov and cyber incidents to CISA.

Say this: If money moves or an account is taken over, I pick up the printed plan and call the bank first.

Check it worked: A printed one- or two-page plan names who leads, who calls the bank, IT provider, insurer and lawyer, and how staff reach each other if email is down; the team has walked through one scenario this year.

Simply put

It's like a fire evacuation plan: everyone knows the exit and the meeting point before the alarm sounds. Deciding roles in advance stops panic, and stops a second scam that pretends to be help.

In detail

Insurers often ask whether you have a tested plan. The out-of-band channel matters because attackers inside a mailbox read your incident emails.

Points toward the Long View: a first hour that goes to plan, whatever the incident turns out to be.

Read more