Reusable practice kit
First-hour incident card
An offline contact and decision card for the first hour of a suspected technology incident.
What the completed kit should do
People can reach the right help and preserve options when ordinary systems or contacts are unavailable.
Capture these facts in your approved system
- Incident lead, backup, safe contact methods, authority, and meeting route
- Technology support, insurer, counsel, financial providers, key vendors, and reporting contacts
- Device isolation, account containment, evidence preservation, and business-continuity boundaries
- Employee, customer, regulator, partner, and public communication authority
- Exercise date, fictional scenario, observed gap, correction owner, and next review
Use the structure in this order
- 01
Confirm a safe way to coordinate and name the incident lead.
- 02
Preserve evidence and contain only through approved actions.
- 03
Contact qualified support appropriate to the facts.
- 04
Record decisions, continue safe operations, and correct the card after review.
Close the practice loop
The card is reachable offline, current, practiced, and understood by the people named on it.
Protect the completed record
- Do not wipe, restore, negotiate, pay, notify, or make public claims without fact-specific qualified review.
- Do not place sensitive incident details on an openly posted contact card.
- Use official provider and government contact routes verified independently.