A one-page incident plan names who decides, lists contacts with phone numbers, says how to isolate and preserve evidence, gives a short holding statement, and points to your backups. CISA advises keeping a basic plan, exercising it and holding a copy offline, because the plan is useless if it lives on the system that is down.
Why a one-pager
A long plan is never read, and nobody reads at 2 a.m. during an outage. One page that you can find without logging in is worth more than thirty pages in a shared drive. CISA's ransomware guide says to "create, maintain, and regularly exercise a basic cyber incident response plan" that includes communications and notification procedures, and to keep a hard copy and an offline version.
The six boxes
| Box | Write |
|---|---|
| Decider | One name, plus a deputy if that person is unreachable |
| Contacts | Hosting provider, domain registrar, payment provider, cyber insurer if you have one, a lawyer, a trusted technical friend |
| First moves | Disconnect or disable affected accounts, rotate credentials, stop deploys |
| Preserve | Save logs, screenshots, timelines before cleaning up |
| Say | A holding statement you can paste to customers, agreed in advance |
| Recover | Where backups are, who can restore, how you know they work |
Agree the holding statement in advance
CISA recommends having holding statement templates and agreeing ahead of time how much detail to share internally and publicly. A short draft such as "We are investigating an issue affecting service X. We will update by time Y" is enough. You can fill in the specifics later.
Decide your reporting duties now
Check whether you have breach notification duties under state law or a customer contract. CISA's guide advises following applicable state breach notification laws and involving legal counsel when needed. A 10-minute read of your own contracts today saves panic later.
Keep backups offline and tested
CISA recommends offline, encrypted backups of critical data, tested regularly, because many ransomware variants hunt for accessible backups. Include source code and infrastructure templates so you can rebuild. A backup you have never restored is a hope.
Run it once
Pick a quiet hour and walk through a pretend event: a leaked key, or a deleted database. Time how long it takes to find the plan, reach each contact and restore. Fix what failed, then put the date of the exercise on the page.
Quick check
Do we need a plan if we have no sensitive data?
Yes, a short one. Even a defaced site or a hijacked domain needs a decider and a contact list.
Where should the page live?
In at least two places, including one that does not depend on your own systems, such as a printed copy or a personal device.
Safeguard compliance and evidence automation can help keep incident records and policy documents together, and a free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
