First-hour incident plan
What belongs in a small-business first-hour incident plan?
A first-hour incident plan names who leads, who must be contacted, which safe actions are preapproved, how evidence and continuity are protected, what must not be changed, and when to involve technology, legal, insurance, financial, privacy, communications, or public authorities.
What the business should be able to see
- Keep a protected copy that remains reachable when normal email, devices, or file storage are unavailable.
- Separate observe, contain, communicate, recover, and document decisions so urgency does not erase ownership.
- Practice with a fictional scenario and update the card when people, providers, accounts, insurance, or obligations change.
What this definition cannot establish
- A general card is not an active incident-response service and cannot determine the right containment, notification, legal, or recovery action for specific facts.
- Suspected theft, fraud, unauthorized access, ransomware, regulated data exposure, or material disruption needs qualified help promptly.