An incident response plan is a short, practical document that explains what a business will do when something goes wrong with its IT security, such as ransomware, a hacked email account, a lost laptop or a data breach. It names who is in charge, who to call and what steps to take.
A good plan covers detection and reporting, containment (for example disconnecting an infected computer), assessment of what was affected, recovery from backups, communication with staff, customers and suppliers, and review afterwards. It lists key contacts: the IT provider, bank, insurer, and where relevant the OAIC and legal advisers.
Retailers and venues should include what happens if tills, payments or online orders go down, because the business must keep trading or at least serve customers manually. Having card-processing contacts and offline procedures ready saves precious time.
Pitfalls include a plan stored only on the affected server, contacts that are out of date, and never practising. Print it or keep it somewhere accessible offline, and run a short tabletop exercise once a year. Check current obligations on data breach notification, as they depend on the business and the data involved.
Decisions made in the first hour often decide how bad an incident becomes, and a plan removes the guesswork.