A one page incident plan names who decides, who to call, the first three actions, and where the plan is stored offline. Write it before a bad day, because finding phone numbers during a compromised email outage is slow. Aim for one page that anyone on the team can follow.
Why one page
Long plans are not read. A small organization needs something a volunteer can open on a phone with panic in the room. The aim is to avoid the three common mistakes: waiting to tell anyone, deleting evidence, and changing the wrong things first.
The template
1. Decision owner. One name, plus a backup. This person decides to shut things down and to contact outsiders.
2. Contact list. Phone numbers, not email addresses, because email may be down.
- Decision owner and backup
- Your IT volunteer or support provider
- Your website host and domain registrar support
- Your bank contact for suspected payment fraud
- Your insurer's incident line if you have cyber insurance
- Your legal counsel, for advice on notification duties
3. First three actions.
- Disconnect the affected device from the network. Do not wipe it.
- Change passwords for the affected account from a different, clean device, and turn on MFA.
- Tell the decision owner and write down what you saw and when.
4. Reporting. CISA's high-risk communities page says organizations should report anomalous cyber activity and cyber incidents to CISA around the clock. That reporting channel is US based. Check your own country's equivalent if you are elsewhere.
5. Where this plan lives. A printed copy in the office and a copy on a personal device, not only in the shared drive that may be locked.
Practice once a year
Spend thirty minutes walking through one scenario. Pick one: a volunteer clicks a bad link, the donation page goes down, or a laptop is lost.
| Scenario | Question to ask |
|---|---|
| Phished account | Who resets it, and who checks what it sent? |
| Lost laptop | Is the disk locked, and what could be seen? |
| Site defaced | Who restores from backup, and how long does that take? |
| Fake payment request | Who verifies by phone before paying? |
Update the contact list after each run.
Things to decide ahead of time
- Who speaks to donors and the press. Pick one person and one message.
- When you tell affected people. Notification duties vary by place and data type. Get advice from your counsel rather than guessing.
- How to preserve evidence. Do not reboot or reinstall until someone has captured what happened, if you can.
Link it to your backups
A plan is only useful if recovery works. Test a restore at least once. See our backup restore test guide for small teams.
Keep it current
Phone numbers go stale and people change roles. Put a recurring reminder in a shared calendar every six months to check each name and number, and to confirm the printed copy matches the digital one. Note the review date at the bottom of the page so nobody trusts an old copy.
Quick check
Do we need a plan if we have no sensitive data?
Yes. Even a hijacked social media account or lost website hurts a small group. The plan can be shorter.
Is this legal advice?
No. Ask a lawyer about notification duties and contracts.
Sources
Last reviewed: 19 October 2026.
